ask-marcel-office-cli 1.5.0 → 1.5.2

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 All notable changes to `ask-marcel-office-cli` are documented here.
 
+## 1.5.2
+
+### Fixed
+
+- **`find-chats-with-user` now surfaces cross-tenant 1:1 chats.** An externally-homed
+  counterpart comes back from the Teams chat roster as a bare object-id — no name, no
+  email — so a name search could never match it, and a real, active 1:1 returned a
+  silent `matchCount: 0`. The command now hydrates every bare **direct (1:1)** chat via
+  `/chats/{id}/members` and re-runs the match, so a cross-tenant counterpart is found
+  even when they were already resolved in a meeting under a different identity. When
+  nothing matches but bare members remain, it returns a `hint` + `unresolvedMemberCount`
+  rather than a confidently-empty result.
+- **`list-chat-members` reads on the basic Teams token** (`ChatMember.Read`) instead of
+  the login-only elevated (M365ChatClient) token, so it no longer fails with "Elevated
+  token expired" on the command path. `next-page` routes `/chats/{id}/members` cursors on
+  the basic token to match. Chat _metadata_ (`list-chats` / `get-chat`) still requires
+  the elevated token.
+
+## 1.5.1
+
+### Fixed
+
+- **No browser window opens per command once a secondary token lapses** (completes
+  the 1.5.0 auth fix). The elevated / Teams-chat (chatsvcagg / ic3) token recaptures
+  each launched a _visible_ browser that "opens and closes within seconds" to
+  silently re-capture — per command, per process, with no cross-process throttle —
+  so after the short-lived elevated token (~59 min) expired, every elevated or
+  Teams-chat command popped a window. The command-path auth now **fails fast** with
+  an actionable "run `ask-marcel login`" instead; browser capture is reserved for
+  the explicit `login` command, which re-captures all four tokens in one session.
+
 ## 1.5.0
 
 Agent-ergonomics, a faster cold-start, a new command, and an LLM-safety pass.
@@ -50,11 +81,11 @@ change to note**: byte commands now refuse to inline a payload over ~1 MB withou
 
 ### Fixed
 
-- **Auth no longer pops a browser per command on re-auth.** A command whose token
-  needed refreshing used to launch the Chrome extension-capture window — once per
-  process, with no cross-process throttle, so a batch/agent run stacked up
-  windows. Command re-auth now uses a headed Edge sign-in (one login re-caches all
-  tokens); the extension capture is reserved for explicit `login --use-extension`.
+- **Auth no longer pops a browser per command on re-auth.** The primary-token
+  refresh-fallback used to launch the Chrome extension-capture window — once per
+  process, with no cross-process throttle, so a batch/agent run stacked up windows.
+  Command re-auth now uses a headed Edge sign-in only when the silent refresh
+  genuinely fails; the extension capture is reserved for explicit `login --use-extension`.
 - **Stale doc numbers** — the `help-json` size hints (terse-category ~16 → ~6 KB
   after the trim) and the README command list now match reality.
 

package/dist/cli.js

@@ -2457,7 +2457,7 @@ import updateNotifier from "update-notifier";
 // package.json
 var package_default = {
   name: "ask-marcel-office-cli",
-  version: "1.5.0",
+  version: "1.5.2",
   description: "Microsoft Graph CLI + library — typed Bun/TypeScript wrapper around 150+ Graph operations (read + on-the-fly PDF/markdown conversion + federated Microsoft Search) reachable from a Teams browser-OAuth token.",
   license: "MIT",
   author: "Vincent Delacourt <vincent.delacourt@adama-development.com>",
@@ -3475,7 +3475,8 @@ var SCOPES = "https://graph.microsoft.com/.default openid profile offline_access
 var SPA_ORIGIN = "https://teams.microsoft.com";
 var TEAMS_URL2 = "https://teams.microsoft.com/";
 var DEFAULT_CHATSVCAGG_REGION2 = "emea";
-var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logger, fs, systemBrowserAuthFn, usePlaywrightFallback = true, skipSystemBrowser = false) => {
+var failFastSecondaryMessage = (token, commands) => `${token} token is expired or was not captured at login. Run \`ask-marcel login\` to (re)capture it — the CLI does not open a browser per command for this token. (Commands that need it: ${commands}.)`;
+var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logger, fs, systemBrowserAuthFn, usePlaywrightFallback = true, skipSystemBrowser = false, recaptureSecondaryViaBrowser = true) => {
   const systemBrowserAuth = systemBrowserAuthFn ?? defaultSystemBrowserAuth(logger, skipSystemBrowser);
   const readCache = async () => {
     const r = await fs.readJson(cachePath);
@@ -3657,12 +3658,12 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
   };
   const recoverableElevatedFailureMessage = (reason) => {
     if (reason === "launch_timeout") {
-      return "elevated browser launch timed out (15s) — likely a corrupt persistent profile or filesystem lock. Run `ask-marcel logout && ask-marcel login` to wipe the profile and retry. (Commands that need this token: list-chats, get-chat, list-chat-members, the historical-version download / convert commands.)";
+      return "elevated browser launch timed out (15s) — likely a corrupt persistent profile or filesystem lock. Run `ask-marcel logout && ask-marcel login` to wipe the profile and retry. (Commands that need this token: list-chats, get-chat, the historical-version download / convert commands.)";
     }
     if (reason === "navigation_failed") {
-      return "elevated capture failed: navigation to m365.cloud.microsoft did not complete — network issue, corp-proxy block, or tenant policy. Check connectivity and retry. If persistent, the elevated commands (list-chats / get-chat / list-chat-members / historical-version downloads) will be unavailable.";
+      return "elevated capture failed: navigation to m365.cloud.microsoft did not complete — network issue, corp-proxy block, or tenant policy. Check connectivity and retry. If persistent, the elevated commands (list-chats / get-chat / historical-version downloads) will be unavailable.";
     }
-    return "elevated token capture timed out — silent SSO against m365.cloud.microsoft did not yield a Bearer within 20s. The persistent browser-profile cookies are likely expired. Run `ask-marcel logout && ask-marcel login` — this now wipes the profile too. (Commands that need this token: list-chats, get-chat, list-chat-members, the historical-version download / convert commands.)";
+    return "elevated token capture timed out — silent SSO against m365.cloud.microsoft did not yield a Bearer within 20s. The persistent browser-profile cookies are likely expired. Run `ask-marcel logout && ask-marcel login` — this now wipes the profile too. (Commands that need this token: list-chats, get-chat, the historical-version download / convert commands.)";
   };
   const recaptureElevated = async () => {
     try {
@@ -3697,6 +3698,8 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       logger.info("auth.elevated.cache_hit");
       return ok(validated.value);
     }
+    if (!recaptureSecondaryViaBrowser)
+      return err({ type: "auth_failed", message: failFastSecondaryMessage("Elevated (M365)", "list-chats, get-chat, download-drive-item-version") });
     return recaptureElevatedShared();
   };
   const freshChatsvcaggToken = (cached) => {
@@ -3747,6 +3750,11 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       logger.info("auth.chatsvcagg.cache_hit");
       return ok(accessTokenUnsafe(fresh));
     }
+    if (!recaptureSecondaryViaBrowser)
+      return err({
+        type: "auth_failed",
+        message: failFastSecondaryMessage("chatsvcagg (Teams chat)", "list-teams-chats-with-messages, list-teams-chat-messages, get-teams-chat-message, find-chats-with-user")
+      });
     return recaptureChatsvcaggShared();
   };
   const getChatsvcaggRegion = async () => {
@@ -3802,6 +3810,8 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       logger.info("auth.ic3.cache_hit");
       return ok(accessTokenUnsafe(fresh));
     }
+    if (!recaptureSecondaryViaBrowser)
+      return err({ type: "auth_failed", message: failFastSecondaryMessage("ic3 (Teams chat history)", "list-teams-chat-history") });
     return recaptureIc3Shared();
   };
   const logout = async () => {
@@ -3859,7 +3869,7 @@ var createAuthManager = (deps) => {
     freshCachedToken: createFreshCachedTokenProbe(fs, deps.cachePath),
     onProgress: stderrProgress
   });
-  return createAuthManagerFromApi(browserAuth, deps.cachePath, browserProfileDir, deps.logger, fs, deps.systemBrowserAuth, deps.usePlaywrightFallback, deps.skipSystemBrowser);
+  return createAuthManagerFromApi(browserAuth, deps.cachePath, browserProfileDir, deps.logger, fs, deps.systemBrowserAuth, deps.usePlaywrightFallback, deps.skipSystemBrowser, deps.recaptureSecondaryViaBrowser);
 };
 // src/infra/network-error.ts
 var REQUEST_TIMEOUT_MS = 60000;
@@ -4338,7 +4348,7 @@ var buildDeps = (config = {}) => {
   const processRunner = config.processRunner ?? defaultProcessRunner();
   const logger = createWinstonLogger({ logLevel });
   const makeAuth = config.createAuth ?? createAuthManager;
-  const auth = makeAuth({ cachePath, logger, fs, skipSystemBrowser: true, usePlaywrightFallback: true });
+  const auth = makeAuth({ cachePath, logger, fs, skipSystemBrowser: true, usePlaywrightFallback: true, recaptureSecondaryViaBrowser: false });
   const graph = createGraphClient(auth);
   const makeLoginAuth = ({ useExtension }) => makeAuth({ cachePath, logger, fs, skipSystemBrowser: !useExtension, usePlaywrightFallback: !useExtension });
   return { logger, auth, graph, processRunner, fs, makeLoginAuth };
@@ -23004,7 +23014,7 @@ __export(exports_list_chat_members, {
 });
 var baseSchema21 = exports_external.object({ chatId: exports_external.string().min(1) });
 var CHAT_MEMBERS_ODATA_KEYS = ["skip", "select", "filter"];
-var inner5 = buildElevatedPickODataListCommand((p) => `/chats/${p.chatId}/members`, baseSchema21, CHAT_MEMBERS_ODATA_KEYS);
+var inner5 = buildPickODataListCommand((p) => `/chats/${p.chatId}/members`, baseSchema21, CHAT_MEMBERS_ODATA_KEYS);
 var execute42 = async (graph, params) => {
   const result = await inner5.execute(graph, params);
   if (result.ok)
@@ -23039,8 +23049,7 @@ var meta44 = {
   ],
   example: "ask-marcel list-chat-members --chat-id '19:abc...@thread.v2'",
   responseShape: "collection of Microsoft Graph `conversationMember` resources under `value[]`",
-  pagination: true,
-  needsElevatedToken: true
+  pagination: true
 };
 
 // src/use-cases/commands/list-drive-item-permissions.ts
@@ -24002,8 +24011,13 @@ __export(exports_next_page, {
   execute: () => execute74
 });
 var PREFIX = "https://graph.microsoft.com/v1.0";
-var ELEVATED_PATH_PREFIXES = ["/me/chats", "/chats/"];
-var requiresElevated = (path) => ELEVATED_PATH_PREFIXES.some((prefix) => path.startsWith(prefix));
+var requiresElevated = (path) => {
+  if (path.startsWith("/me/chats"))
+    return true;
+  if (path.startsWith("/chats/"))
+    return !path.includes("/members");
+  return false;
+};
 var schema74 = exports_external.object({
   url: exports_external.string().min(1).refine((v) => v.startsWith(`${PREFIX}/`), { message: `must be a Microsoft Graph v1.0 URL starting with ${PREFIX}/` })
 });
@@ -26621,15 +26635,43 @@ var projectMember = (m) => {
     out.userSubType = m.userSubType;
   return out;
 };
-var execute107 = async (graph, params) => {
-  const parsed = schema107.safeParse(params);
-  if (!parsed.success)
-    return err({ type: "validation_error", message: formatZodError(parsed.error) });
-  const queryFolded = fold(parsed.data.name);
-  const pageSize = parsed.data.pageSize ?? "100";
-  const maxPages = Number(parsed.data.maxPages ?? "10");
-  const matched = [];
-  const seenChatIds = new Set;
+var isNameResolvable = (m) => {
+  const fields = [m.displayName, m.email, m.userPrincipalName, m.givenName, m.surname];
+  return fields.some((f) => typeof f === "string" && f.trim() !== "");
+};
+var bareMemberCount = (members) => members.filter((m) => !isNameResolvable(m)).length;
+var fromGraphMember = (g) => ({
+  ...g.displayName !== undefined ? { displayName: g.displayName } : {},
+  ...g.email !== undefined ? { email: g.email } : {},
+  ...typeof g.userId === "string" ? { mri: `8:orgid:${g.userId}`, objectId: g.userId } : {}
+});
+var toMatchedChat = (chatId, chat, members) => ({
+  chatId,
+  title: chat.title ?? null,
+  chatType: chat.chatType,
+  threadType: chat.threadType,
+  memberCount: (chat.members ?? []).length,
+  ...chat.lastMessage?.composeTime !== undefined ? { lastMessageAt: chat.lastMessage.composeTime } : {},
+  matchedMembers: members.map(projectMember)
+});
+var collectChat = (chat, queryFolded, acc) => {
+  if (chat.id === undefined || acc.seen.has(chat.id))
+    return;
+  const members = chat.members ?? [];
+  const hits = members.filter((m) => memberMatches(m, queryFolded));
+  if (hits.length > 0) {
+    acc.seen.add(chat.id);
+    acc.matched.push(toMatchedChat(chat.id, chat, hits));
+    return;
+  }
+  const bareCount = bareMemberCount(members);
+  if (bareCount > 0) {
+    acc.seen.add(chat.id);
+    acc.bareUnmatched.push({ chatId: chat.id, chat, bareCount });
+  }
+};
+var scanChatPages = async (graph, queryFolded, pageSize, maxPages) => {
+  const acc = { seen: new Set, matched: [], bareUnmatched: [] };
   let continuationToken;
   let pagesFetched = 0;
   let chatsScanned = 0;
@@ -26644,42 +26686,67 @@ var execute107 = async (graph, params) => {
     const chats = body.chats ?? [];
     pagesFetched += 1;
     chatsScanned += chats.length;
-    for (const chat of chats) {
-      if (chat.id === undefined || seenChatIds.has(chat.id))
-        continue;
-      const members = chat.members ?? [];
-      const matchedMembers = members.filter((m) => memberMatches(m, queryFolded));
-      if (matchedMembers.length === 0)
-        continue;
-      seenChatIds.add(chat.id);
-      matched.push({
-        chatId: chat.id,
-        title: chat.title ?? null,
-        chatType: chat.chatType,
-        threadType: chat.threadType,
-        memberCount: members.length,
-        ...chat.lastMessage?.composeTime !== undefined ? { lastMessageAt: chat.lastMessage.composeTime } : {},
-        matchedMembers: matchedMembers.map(projectMember)
-      });
-    }
+    for (const chat of chats)
+      collectChat(chat, queryFolded, acc);
     if (body.hasMoreData !== true || body.continuationToken === undefined) {
       continuationToken = undefined;
       break;
     }
     continuationToken = body.continuationToken;
   }
+  return ok({ matched: acc.matched, bareUnmatched: acc.bareUnmatched, pagesFetched, chatsScanned, continuationToken });
+};
+var sumBareCounts = (bare) => bare.reduce((n, b) => n + b.bareCount, 0);
+var hydrateMatches = async (graph, chatId, queryFolded) => {
+  const res = await graph.get(`/chats/${chatId}/members`);
+  if (!res.ok)
+    return null;
+  const value = res.value.value ?? [];
+  return value.map(fromGraphMember).filter((m) => memberMatches(m, queryFolded));
+};
+var isDirectChat = (chatId) => chatId.endsWith("@unq.gbl.spaces");
+var hydrateBareDirect = async (graph, queryFolded, bareUnmatched, matched) => {
+  const direct = bareUnmatched.filter((b) => isDirectChat(b.chatId));
+  let unresolvedMemberCount = sumBareCounts(bareUnmatched.filter((b) => !isDirectChat(b.chatId)));
+  const results = await Promise.all(direct.map(async (b) => ({ bare: b, hits: await hydrateMatches(graph, b.chatId, queryFolded) })));
+  for (const { bare, hits } of results) {
+    if (hits === null) {
+      unresolvedMemberCount += bare.bareCount;
+      continue;
+    }
+    if (hits.length > 0)
+      matched.push(toMatchedChat(bare.chatId, bare.chat, hits));
+  }
+  return { chatsHydrated: direct.length, unresolvedMemberCount };
+};
+var HINT2 = "No chat member matched by name, but at least one chat has a cross-tenant member the Teams roster left unresolved — an externally-homed counterpart often appears only as a bare object-id. Direct 1:1 chats were deep-probed; members in group/meeting chats were not. Retry searching by their object-id (pass it as `--name <object-id>`), or, if you have the chat URL, read it directly with `get-chat` / `list-teams-chat-messages --chat-id 19:<their-oid>_<your-oid>@unq.gbl.spaces`.";
+var execute107 = async (graph, params) => {
+  const parsed = schema107.safeParse(params);
+  if (!parsed.success)
+    return err({ type: "validation_error", message: formatZodError(parsed.error) });
+  const queryFolded = fold(parsed.data.name);
+  const pageSize = parsed.data.pageSize ?? "100";
+  const maxPages = Number(parsed.data.maxPages ?? "20");
+  const scan = await scanChatPages(graph, queryFolded, pageSize, maxPages);
+  if (!scan.ok)
+    return scan;
+  const { matched, bareUnmatched, pagesFetched, chatsScanned, continuationToken } = scan.value;
+  const { chatsHydrated, unresolvedMemberCount } = await hydrateBareDirect(graph, queryFolded, bareUnmatched, matched);
   return ok({
     name: parsed.data.name,
     matches: matched,
     matchCount: matched.length,
     pagesFetched,
     chatsScanned,
+    chatsHydrated,
+    unresolvedMemberCount,
     hasMore: continuationToken !== undefined,
-    nextContinuationToken: continuationToken
+    nextContinuationToken: continuationToken,
+    ...matched.length === 0 && unresolvedMemberCount > 0 ? { hint: HINT2 } : {}
   });
 };
 var meta109 = {
-  summary: 'Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.',
+  summary: 'Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). Cross-tenant resolution: the summary roster returns externally-homed counterparts as a bare object-id (no name/email), which a name search cannot match; for every bare DIRECT (1:1) chat the command hydrates the roster via the per-chat members endpoint and re-matches — so an external counterpart who is bare in your 1:1 is still found, even when they were already resolved in some meeting (the dual-identity case). Bare members in group/meeting chats are not deep-probed; when nothing matches and such members exist it returns a `hint` plus `unresolvedMemberCount` rather than a confident empty result. **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.',
   category: "chats",
   needsSubstrateToken: true,
   graphMethod: "GET",
@@ -26696,7 +26763,7 @@ var meta109 = {
       name: "max-pages",
       key: "maxPages",
       required: false,
-      description: "Safety cap on the chat-list walk (positive integer; default 10). Each page returns up to `--page-size` chats. Raise carefully on busy accounts — every page is one HTTP round-trip."
+      description: "Safety cap on the chat-list walk (positive integer; default 20). The walk stops early once the substrate reports no more pages, so the cap only bites on accounts with more chats than `--max-pages × --page-size`; raise it (and watch `hasMore`) if a known chat is missed. Each page is one HTTP round-trip."
     },
     {
       name: "page-size",
@@ -26706,7 +26773,7 @@ var meta109 = {
     }
   ],
   example: "ask-marcel find-chats-with-user --name 'Jane DOE'",
-  responseShape: "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, hasMore, nextContinuationToken? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
+  responseShape: "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, chatsHydrated, unresolvedMemberCount, hasMore, nextContinuationToken?, hint? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `chatsHydrated` counts the per-chat members lookups spent resolving bare cross-tenant members in direct (1:1) chats. `unresolvedMemberCount` is how many cross-tenant members are still unresolved by name (bare members in group/meeting chats, which are not deep-probed, plus any 1:1 hydration that errored); when `matchCount` is 0 and this is non-zero, a `hint` is present explaining the likely cause and the object-id / read-by-chat-id remedy — so an empty result is never silently confident. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
   stability: "experimental"
 };
 

package/dist/commands.json

@@ -1,7 +1,7 @@
 {
   "package": "ask-marcel-office-cli",
-  "version": "1.5.0",
-  "generatedAt": "2026-06-16T16:14:42.738Z",
+  "version": "1.5.2",
+  "generatedAt": "2026-06-23T11:35:14.255Z",
   "commands": [
     {
       "name": "convert-calendar-event-attachment-to-markdown",
@@ -666,7 +666,7 @@
     },
     {
       "name": "find-chats-with-user",
-      "summary": "Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical \"all conversations with person X\" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.",
+      "summary": "Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical \"all conversations with person X\" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). Cross-tenant resolution: the summary roster returns externally-homed counterparts as a bare object-id (no name/email), which a name search cannot match; for every bare DIRECT (1:1) chat the command hydrates the roster via the per-chat members endpoint and re-matches — so an external counterpart who is bare in your 1:1 is still found, even when they were already resolved in some meeting (the dual-identity case). Bare members in group/meeting chats are not deep-probed; when nothing matches and such members exist it returns a `hint` plus `unresolvedMemberCount` rather than a confident empty result. **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.",
       "category": "chats",
       "graphMethod": "GET",
       "graphPathTemplate": "https://teams.microsoft.com/api/csa/{region}/api/v3/teams/users/me/chats",
@@ -682,7 +682,7 @@
           "name": "max-pages",
           "key": "maxPages",
           "required": false,
-          "description": "Safety cap on the chat-list walk (positive integer; default 10). Each page returns up to `--page-size` chats. Raise carefully on busy accounts — every page is one HTTP round-trip."
+          "description": "Safety cap on the chat-list walk (positive integer; default 20). The walk stops early once the substrate reports no more pages, so the cap only bites on accounts with more chats than `--max-pages × --page-size`; raise it (and watch `hasMore`) if a known chat is missed. Each page is one HTTP round-trip."
         },
         {
           "name": "page-size",
@@ -692,7 +692,7 @@
         }
       ],
       "example": "ask-marcel find-chats-with-user --name 'Jane DOE'",
-      "responseShape": "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, hasMore, nextContinuationToken? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
+      "responseShape": "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, chatsHydrated, unresolvedMemberCount, hasMore, nextContinuationToken?, hint? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `chatsHydrated` counts the per-chat members lookups spent resolving bare cross-tenant members in direct (1:1) chats. `unresolvedMemberCount` is how many cross-tenant members are still unresolved by name (bare members in group/meeting chats, which are not deep-probed, plus any 1:1 hydration that errored); when `matchCount` is 0 and this is non-zero, a `hint` is present explaining the likely cause and the object-id / read-by-chat-id remedy — so an empty result is never silently confident. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
       "needsSubstrateToken": true,
       "stability": "experimental"
     },
@@ -2987,8 +2987,7 @@
       ],
       "example": "ask-marcel list-chat-members --chat-id '19:abc...@thread.v2'",
       "responseShape": "collection of Microsoft Graph `conversationMember` resources under `value[]`",
-      "pagination": true,
-      "needsElevatedToken": true
+      "pagination": true
     },
     {
       "name": "list-chats",

package/dist/index.js

@@ -1249,7 +1249,8 @@ var SCOPES = "https://graph.microsoft.com/.default openid profile offline_access
 var SPA_ORIGIN = "https://teams.microsoft.com";
 var TEAMS_URL2 = "https://teams.microsoft.com/";
 var DEFAULT_CHATSVCAGG_REGION2 = "emea";
-var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logger, fs, systemBrowserAuthFn, usePlaywrightFallback = true, skipSystemBrowser = false) => {
+var failFastSecondaryMessage = (token, commands) => `${token} token is expired or was not captured at login. Run \`ask-marcel login\` to (re)capture it — the CLI does not open a browser per command for this token. (Commands that need it: ${commands}.)`;
+var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logger, fs, systemBrowserAuthFn, usePlaywrightFallback = true, skipSystemBrowser = false, recaptureSecondaryViaBrowser = true) => {
   const systemBrowserAuth = systemBrowserAuthFn ?? defaultSystemBrowserAuth(logger, skipSystemBrowser);
   const readCache = async () => {
     const r = await fs.readJson(cachePath);
@@ -1431,12 +1432,12 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
   };
   const recoverableElevatedFailureMessage = (reason) => {
     if (reason === "launch_timeout") {
-      return "elevated browser launch timed out (15s) — likely a corrupt persistent profile or filesystem lock. Run `ask-marcel logout && ask-marcel login` to wipe the profile and retry. (Commands that need this token: list-chats, get-chat, list-chat-members, the historical-version download / convert commands.)";
+      return "elevated browser launch timed out (15s) — likely a corrupt persistent profile or filesystem lock. Run `ask-marcel logout && ask-marcel login` to wipe the profile and retry. (Commands that need this token: list-chats, get-chat, the historical-version download / convert commands.)";
     }
     if (reason === "navigation_failed") {
-      return "elevated capture failed: navigation to m365.cloud.microsoft did not complete — network issue, corp-proxy block, or tenant policy. Check connectivity and retry. If persistent, the elevated commands (list-chats / get-chat / list-chat-members / historical-version downloads) will be unavailable.";
+      return "elevated capture failed: navigation to m365.cloud.microsoft did not complete — network issue, corp-proxy block, or tenant policy. Check connectivity and retry. If persistent, the elevated commands (list-chats / get-chat / historical-version downloads) will be unavailable.";
     }
-    return "elevated token capture timed out — silent SSO against m365.cloud.microsoft did not yield a Bearer within 20s. The persistent browser-profile cookies are likely expired. Run `ask-marcel logout && ask-marcel login` — this now wipes the profile too. (Commands that need this token: list-chats, get-chat, list-chat-members, the historical-version download / convert commands.)";
+    return "elevated token capture timed out — silent SSO against m365.cloud.microsoft did not yield a Bearer within 20s. The persistent browser-profile cookies are likely expired. Run `ask-marcel logout && ask-marcel login` — this now wipes the profile too. (Commands that need this token: list-chats, get-chat, the historical-version download / convert commands.)";
   };
   const recaptureElevated = async () => {
     try {
@@ -1471,6 +1472,8 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       logger.info("auth.elevated.cache_hit");
       return ok(validated.value);
     }
+    if (!recaptureSecondaryViaBrowser)
+      return err({ type: "auth_failed", message: failFastSecondaryMessage("Elevated (M365)", "list-chats, get-chat, download-drive-item-version") });
     return recaptureElevatedShared();
   };
   const freshChatsvcaggToken = (cached) => {
@@ -1521,6 +1524,11 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       logger.info("auth.chatsvcagg.cache_hit");
       return ok(accessTokenUnsafe(fresh));
     }
+    if (!recaptureSecondaryViaBrowser)
+      return err({
+        type: "auth_failed",
+        message: failFastSecondaryMessage("chatsvcagg (Teams chat)", "list-teams-chats-with-messages, list-teams-chat-messages, get-teams-chat-message, find-chats-with-user")
+      });
     return recaptureChatsvcaggShared();
   };
   const getChatsvcaggRegion = async () => {
@@ -1576,6 +1584,8 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       logger.info("auth.ic3.cache_hit");
       return ok(accessTokenUnsafe(fresh));
     }
+    if (!recaptureSecondaryViaBrowser)
+      return err({ type: "auth_failed", message: failFastSecondaryMessage("ic3 (Teams chat history)", "list-teams-chat-history") });
     return recaptureIc3Shared();
   };
   const logout = async () => {
@@ -1633,7 +1643,7 @@ var createAuthManager = (deps) => {
     freshCachedToken: createFreshCachedTokenProbe(fs, deps.cachePath),
     onProgress: stderrProgress
   });
-  return createAuthManagerFromApi(browserAuth, deps.cachePath, browserProfileDir, deps.logger, fs, deps.systemBrowserAuth, deps.usePlaywrightFallback, deps.skipSystemBrowser);
+  return createAuthManagerFromApi(browserAuth, deps.cachePath, browserProfileDir, deps.logger, fs, deps.systemBrowserAuth, deps.usePlaywrightFallback, deps.skipSystemBrowser, deps.recaptureSecondaryViaBrowser);
 };
 // src/infra/network-error.ts
 var REQUEST_TIMEOUT_MS = 60000;
@@ -19896,7 +19906,7 @@ __export(exports_list_chat_members, {
 });
 var baseSchema21 = exports_external.object({ chatId: exports_external.string().min(1) });
 var CHAT_MEMBERS_ODATA_KEYS = ["skip", "select", "filter"];
-var inner5 = buildElevatedPickODataListCommand((p) => `/chats/${p.chatId}/members`, baseSchema21, CHAT_MEMBERS_ODATA_KEYS);
+var inner5 = buildPickODataListCommand((p) => `/chats/${p.chatId}/members`, baseSchema21, CHAT_MEMBERS_ODATA_KEYS);
 var execute42 = async (graph, params) => {
   const result = await inner5.execute(graph, params);
   if (result.ok)
@@ -19931,8 +19941,7 @@ var meta44 = {
   ],
   example: "ask-marcel list-chat-members --chat-id '19:abc...@thread.v2'",
   responseShape: "collection of Microsoft Graph `conversationMember` resources under `value[]`",
-  pagination: true,
-  needsElevatedToken: true
+  pagination: true
 };
 
 // src/use-cases/commands/list-drive-item-permissions.ts
@@ -20894,8 +20903,13 @@ __export(exports_next_page, {
   execute: () => execute74
 });
 var PREFIX = "https://graph.microsoft.com/v1.0";
-var ELEVATED_PATH_PREFIXES = ["/me/chats", "/chats/"];
-var requiresElevated = (path) => ELEVATED_PATH_PREFIXES.some((prefix) => path.startsWith(prefix));
+var requiresElevated = (path) => {
+  if (path.startsWith("/me/chats"))
+    return true;
+  if (path.startsWith("/chats/"))
+    return !path.includes("/members");
+  return false;
+};
 var schema74 = exports_external.object({
   url: exports_external.string().min(1).refine((v) => v.startsWith(`${PREFIX}/`), { message: `must be a Microsoft Graph v1.0 URL starting with ${PREFIX}/` })
 });
@@ -23513,15 +23527,43 @@ var projectMember = (m) => {
     out.userSubType = m.userSubType;
   return out;
 };
-var execute107 = async (graph, params) => {
-  const parsed = schema107.safeParse(params);
-  if (!parsed.success)
-    return err({ type: "validation_error", message: formatZodError(parsed.error) });
-  const queryFolded = fold(parsed.data.name);
-  const pageSize = parsed.data.pageSize ?? "100";
-  const maxPages = Number(parsed.data.maxPages ?? "10");
-  const matched = [];
-  const seenChatIds = new Set;
+var isNameResolvable = (m) => {
+  const fields = [m.displayName, m.email, m.userPrincipalName, m.givenName, m.surname];
+  return fields.some((f) => typeof f === "string" && f.trim() !== "");
+};
+var bareMemberCount = (members) => members.filter((m) => !isNameResolvable(m)).length;
+var fromGraphMember = (g) => ({
+  ...g.displayName !== undefined ? { displayName: g.displayName } : {},
+  ...g.email !== undefined ? { email: g.email } : {},
+  ...typeof g.userId === "string" ? { mri: `8:orgid:${g.userId}`, objectId: g.userId } : {}
+});
+var toMatchedChat = (chatId, chat, members) => ({
+  chatId,
+  title: chat.title ?? null,
+  chatType: chat.chatType,
+  threadType: chat.threadType,
+  memberCount: (chat.members ?? []).length,
+  ...chat.lastMessage?.composeTime !== undefined ? { lastMessageAt: chat.lastMessage.composeTime } : {},
+  matchedMembers: members.map(projectMember)
+});
+var collectChat = (chat, queryFolded, acc) => {
+  if (chat.id === undefined || acc.seen.has(chat.id))
+    return;
+  const members = chat.members ?? [];
+  const hits = members.filter((m) => memberMatches(m, queryFolded));
+  if (hits.length > 0) {
+    acc.seen.add(chat.id);
+    acc.matched.push(toMatchedChat(chat.id, chat, hits));
+    return;
+  }
+  const bareCount = bareMemberCount(members);
+  if (bareCount > 0) {
+    acc.seen.add(chat.id);
+    acc.bareUnmatched.push({ chatId: chat.id, chat, bareCount });
+  }
+};
+var scanChatPages = async (graph, queryFolded, pageSize, maxPages) => {
+  const acc = { seen: new Set, matched: [], bareUnmatched: [] };
   let continuationToken;
   let pagesFetched = 0;
   let chatsScanned = 0;
@@ -23536,42 +23578,67 @@ var execute107 = async (graph, params) => {
     const chats = body.chats ?? [];
     pagesFetched += 1;
     chatsScanned += chats.length;
-    for (const chat of chats) {
-      if (chat.id === undefined || seenChatIds.has(chat.id))
-        continue;
-      const members = chat.members ?? [];
-      const matchedMembers = members.filter((m) => memberMatches(m, queryFolded));
-      if (matchedMembers.length === 0)
-        continue;
-      seenChatIds.add(chat.id);
-      matched.push({
-        chatId: chat.id,
-        title: chat.title ?? null,
-        chatType: chat.chatType,
-        threadType: chat.threadType,
-        memberCount: members.length,
-        ...chat.lastMessage?.composeTime !== undefined ? { lastMessageAt: chat.lastMessage.composeTime } : {},
-        matchedMembers: matchedMembers.map(projectMember)
-      });
-    }
+    for (const chat of chats)
+      collectChat(chat, queryFolded, acc);
     if (body.hasMoreData !== true || body.continuationToken === undefined) {
       continuationToken = undefined;
       break;
     }
     continuationToken = body.continuationToken;
   }
+  return ok({ matched: acc.matched, bareUnmatched: acc.bareUnmatched, pagesFetched, chatsScanned, continuationToken });
+};
+var sumBareCounts = (bare) => bare.reduce((n, b) => n + b.bareCount, 0);
+var hydrateMatches = async (graph, chatId, queryFolded) => {
+  const res = await graph.get(`/chats/${chatId}/members`);
+  if (!res.ok)
+    return null;
+  const value = res.value.value ?? [];
+  return value.map(fromGraphMember).filter((m) => memberMatches(m, queryFolded));
+};
+var isDirectChat = (chatId) => chatId.endsWith("@unq.gbl.spaces");
+var hydrateBareDirect = async (graph, queryFolded, bareUnmatched, matched) => {
+  const direct = bareUnmatched.filter((b) => isDirectChat(b.chatId));
+  let unresolvedMemberCount = sumBareCounts(bareUnmatched.filter((b) => !isDirectChat(b.chatId)));
+  const results = await Promise.all(direct.map(async (b) => ({ bare: b, hits: await hydrateMatches(graph, b.chatId, queryFolded) })));
+  for (const { bare, hits } of results) {
+    if (hits === null) {
+      unresolvedMemberCount += bare.bareCount;
+      continue;
+    }
+    if (hits.length > 0)
+      matched.push(toMatchedChat(bare.chatId, bare.chat, hits));
+  }
+  return { chatsHydrated: direct.length, unresolvedMemberCount };
+};
+var HINT2 = "No chat member matched by name, but at least one chat has a cross-tenant member the Teams roster left unresolved — an externally-homed counterpart often appears only as a bare object-id. Direct 1:1 chats were deep-probed; members in group/meeting chats were not. Retry searching by their object-id (pass it as `--name <object-id>`), or, if you have the chat URL, read it directly with `get-chat` / `list-teams-chat-messages --chat-id 19:<their-oid>_<your-oid>@unq.gbl.spaces`.";
+var execute107 = async (graph, params) => {
+  const parsed = schema107.safeParse(params);
+  if (!parsed.success)
+    return err({ type: "validation_error", message: formatZodError(parsed.error) });
+  const queryFolded = fold(parsed.data.name);
+  const pageSize = parsed.data.pageSize ?? "100";
+  const maxPages = Number(parsed.data.maxPages ?? "20");
+  const scan = await scanChatPages(graph, queryFolded, pageSize, maxPages);
+  if (!scan.ok)
+    return scan;
+  const { matched, bareUnmatched, pagesFetched, chatsScanned, continuationToken } = scan.value;
+  const { chatsHydrated, unresolvedMemberCount } = await hydrateBareDirect(graph, queryFolded, bareUnmatched, matched);
   return ok({
     name: parsed.data.name,
     matches: matched,
     matchCount: matched.length,
     pagesFetched,
     chatsScanned,
+    chatsHydrated,
+    unresolvedMemberCount,
     hasMore: continuationToken !== undefined,
-    nextContinuationToken: continuationToken
+    nextContinuationToken: continuationToken,
+    ...matched.length === 0 && unresolvedMemberCount > 0 ? { hint: HINT2 } : {}
   });
 };
 var meta109 = {
-  summary: 'Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.',
+  summary: 'Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). Cross-tenant resolution: the summary roster returns externally-homed counterparts as a bare object-id (no name/email), which a name search cannot match; for every bare DIRECT (1:1) chat the command hydrates the roster via the per-chat members endpoint and re-matches — so an external counterpart who is bare in your 1:1 is still found, even when they were already resolved in some meeting (the dual-identity case). Bare members in group/meeting chats are not deep-probed; when nothing matches and such members exist it returns a `hint` plus `unresolvedMemberCount` rather than a confident empty result. **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.',
   category: "chats",
   needsSubstrateToken: true,
   graphMethod: "GET",
@@ -23588,7 +23655,7 @@ var meta109 = {
       name: "max-pages",
       key: "maxPages",
       required: false,
-      description: "Safety cap on the chat-list walk (positive integer; default 10). Each page returns up to `--page-size` chats. Raise carefully on busy accounts — every page is one HTTP round-trip."
+      description: "Safety cap on the chat-list walk (positive integer; default 20). The walk stops early once the substrate reports no more pages, so the cap only bites on accounts with more chats than `--max-pages × --page-size`; raise it (and watch `hasMore`) if a known chat is missed. Each page is one HTTP round-trip."
     },
     {
       name: "page-size",
@@ -23598,7 +23665,7 @@ var meta109 = {
     }
   ],
   example: "ask-marcel find-chats-with-user --name 'Jane DOE'",
-  responseShape: "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, hasMore, nextContinuationToken? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
+  responseShape: "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, chatsHydrated, unresolvedMemberCount, hasMore, nextContinuationToken?, hint? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `chatsHydrated` counts the per-chat members lookups spent resolving bare cross-tenant members in direct (1:1) chats. `unresolvedMemberCount` is how many cross-tenant members are still unresolved by name (bare members in group/meeting chats, which are not deep-probed, plus any 1:1 hydration that errored); when `matchCount` is 0 and this is non-zero, a `hint` is present explaining the likely cause and the object-id / read-by-chat-id remedy — so an empty result is never silently confident. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
   stability: "experimental"
 };
 
@@ -26018,7 +26085,7 @@ var buildDeps = (config2 = {}) => {
   const processRunner = config2.processRunner ?? defaultProcessRunner();
   const logger = createWinstonLogger({ logLevel });
   const makeAuth = config2.createAuth ?? createAuthManager;
-  const auth = makeAuth({ cachePath, logger, fs, skipSystemBrowser: true, usePlaywrightFallback: true });
+  const auth = makeAuth({ cachePath, logger, fs, skipSystemBrowser: true, usePlaywrightFallback: true, recaptureSecondaryViaBrowser: false });
   const graph = createGraphClient(auth);
   const makeLoginAuth = ({ useExtension }) => makeAuth({ cachePath, logger, fs, skipSystemBrowser: !useExtension, usePlaywrightFallback: !useExtension });
   return { logger, auth, graph, processRunner, fs, makeLoginAuth };

package/dist/infra/auth.d.ts

@@ -81,7 +81,7 @@ type SystemBrowserAuthFn = () => Promise<Result<{
     type: string;
     message: string;
 }>>;
-declare const createAuthManagerFromApi: (browserAuth: BrowserAuth, cachePath: string, browserProfileDir: string, logger: Logger, fs: FileSystem, systemBrowserAuthFn?: SystemBrowserAuthFn, usePlaywrightFallback?: boolean, skipSystemBrowser?: boolean) => AuthManager;
+declare const createAuthManagerFromApi: (browserAuth: BrowserAuth, cachePath: string, browserProfileDir: string, logger: Logger, fs: FileSystem, systemBrowserAuthFn?: SystemBrowserAuthFn, usePlaywrightFallback?: boolean, skipSystemBrowser?: boolean, recaptureSecondaryViaBrowser?: boolean) => AuthManager;
 /**
  * QA-010: probe the token cache for a fresh access token. Handed to the
  * browser capture so its poll loop can short-circuit the multi-minute dance
@@ -99,6 +99,7 @@ declare const createAuthManager: (deps: {
     systemBrowserAuth?: SystemBrowserAuthFn;
     usePlaywrightFallback?: boolean;
     skipSystemBrowser?: boolean;
+    recaptureSecondaryViaBrowser?: boolean;
 }) => AuthManager;
 export { createAuthManager, createAuthManagerFromApi, createFreshCachedTokenProbe, stderrProgress };
 export type { AuthError, AuthManager, ElevatedOutcome, SystemBrowserAuthFn };

package/docs/COMMANDS.md

@@ -223,7 +223,7 @@ For everything else:
 
 | Command | Description | Required params | Graph endpoint |
 |---------|-------------|-----------------|----------------|
-| `find-chats-with-user` | Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API. | `--name`, `--max-pages`, `--page-size` | `GET https://teams.microsoft.com/api/csa/{region}/api/v3/teams/users/me/chats` |
+| `find-chats-with-user` | Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). Cross-tenant resolution: the summary roster returns externally-homed counterparts as a bare object-id (no name/email), which a name search cannot match; for every bare DIRECT (1:1) chat the command hydrates the roster via the per-chat members endpoint and re-matches — so an external counterpart who is bare in your 1:1 is still found, even when they were already resolved in some meeting (the dual-identity case). Bare members in group/meeting chats are not deep-probed; when nothing matches and such members exist it returns a `hint` plus `unresolvedMemberCount` rather than a confident empty result. **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API. | `--name`, `--max-pages`, `--page-size` | `GET https://teams.microsoft.com/api/csa/{region}/api/v3/teams/users/me/chats` |
 | `get-chat` | Return metadata for a single Microsoft Teams chat (1:1, group, or meeting). The CLI ships a slim default `--select=id,topic,chatType,createdDateTime,lastUpdatedDateTime`; pass `--select id,topic,webUrl,onlineMeetingInfo` (or any other comma-separated field list) to widen. Pass `--expand members` to inline membership. Returns metadata only — not the messages (which need `Chat.Read*`). Requires the M365ChatClient elevated token captured at login (the basic Teams web client token lacks `Chat.ReadBasic`). | `--chat-id`, `--select`, `--expand` | `GET /chats/{chat-id}` |
 | `get-teams-chat-message` | Return a single Microsoft Teams chat message by its id via the chat substrate. Uses the chatsvcagg-audience bearer captured at login (same identity as the basic Teams token, different audience). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API. Source the chat-id + message-id via `list-teams-chats-with-messages` or `list-teams-chat-messages`. | `--chat-id`, `--message-id` | `GET https://teams.microsoft.com/api/csa/{region}/api/v1/chats/{chat-id}/messages/{message-id}` |
 | `list-chat-members` | List the members of a single Microsoft Teams chat. Graph rejects `$top` / `$orderby` / `$expand` on this endpoint, so the CLI advertises only the subset Graph honours (`--skip`, `--select`, `--filter`). | `--chat-id`, `--skip`, `--select`, `--filter` | `GET /chats/{chat-id}/members` |

package/docs/commands.json

@@ -1,7 +1,7 @@
 {
   "package": "ask-marcel-office-cli",
-  "version": "1.5.0",
-  "generatedAt": "2026-06-16T16:14:42.738Z",
+  "version": "1.5.2",
+  "generatedAt": "2026-06-23T11:35:14.255Z",
   "commands": [
     {
       "name": "convert-calendar-event-attachment-to-markdown",
@@ -666,7 +666,7 @@
     },
     {
       "name": "find-chats-with-user",
-      "summary": "Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical \"all conversations with person X\" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.",
+      "summary": "Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical \"all conversations with person X\" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). Cross-tenant resolution: the summary roster returns externally-homed counterparts as a bare object-id (no name/email), which a name search cannot match; for every bare DIRECT (1:1) chat the command hydrates the roster via the per-chat members endpoint and re-matches — so an external counterpart who is bare in your 1:1 is still found, even when they were already resolved in some meeting (the dual-identity case). Bare members in group/meeting chats are not deep-probed; when nothing matches and such members exist it returns a `hint` plus `unresolvedMemberCount` rather than a confident empty result. **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.",
       "category": "chats",
       "graphMethod": "GET",
       "graphPathTemplate": "https://teams.microsoft.com/api/csa/{region}/api/v3/teams/users/me/chats",
@@ -682,7 +682,7 @@
           "name": "max-pages",
           "key": "maxPages",
           "required": false,
-          "description": "Safety cap on the chat-list walk (positive integer; default 10). Each page returns up to `--page-size` chats. Raise carefully on busy accounts — every page is one HTTP round-trip."
+          "description": "Safety cap on the chat-list walk (positive integer; default 20). The walk stops early once the substrate reports no more pages, so the cap only bites on accounts with more chats than `--max-pages × --page-size`; raise it (and watch `hasMore`) if a known chat is missed. Each page is one HTTP round-trip."
         },
         {
           "name": "page-size",
@@ -692,7 +692,7 @@
         }
       ],
       "example": "ask-marcel find-chats-with-user --name 'Jane DOE'",
-      "responseShape": "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, hasMore, nextContinuationToken? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
+      "responseShape": "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, chatsHydrated, unresolvedMemberCount, hasMore, nextContinuationToken?, hint? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `chatsHydrated` counts the per-chat members lookups spent resolving bare cross-tenant members in direct (1:1) chats. `unresolvedMemberCount` is how many cross-tenant members are still unresolved by name (bare members in group/meeting chats, which are not deep-probed, plus any 1:1 hydration that errored); when `matchCount` is 0 and this is non-zero, a `hint` is present explaining the likely cause and the object-id / read-by-chat-id remedy — so an empty result is never silently confident. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
       "needsSubstrateToken": true,
       "stability": "experimental"
     },
@@ -2987,8 +2987,7 @@
       ],
       "example": "ask-marcel list-chat-members --chat-id '19:abc...@thread.v2'",
       "responseShape": "collection of Microsoft Graph `conversationMember` resources under `value[]`",
-      "pagination": true,
-      "needsElevatedToken": true
+      "pagination": true
     },
     {
       "name": "list-chats",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ask-marcel-office-cli",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "Microsoft Graph CLI + library \u2014 typed Bun/TypeScript wrapper around 150+ Graph operations (read + on-the-fly PDF/markdown conversion + federated Microsoft Search) reachable from a Teams browser-OAuth token.",
   "license": "MIT",
   "author": "Vincent Delacourt <vincent.delacourt@adama-development.com>",