ask-marcel-office-cli 1.5.1 → 1.5.2

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to `ask-marcel-office-cli` are documented here.
 
+## 1.5.2
+
+### Fixed
+
+- **`find-chats-with-user` now surfaces cross-tenant 1:1 chats.** An externally-homed
+  counterpart comes back from the Teams chat roster as a bare object-id — no name, no
+  email — so a name search could never match it, and a real, active 1:1 returned a
+  silent `matchCount: 0`. The command now hydrates every bare **direct (1:1)** chat via
+  `/chats/{id}/members` and re-runs the match, so a cross-tenant counterpart is found
+  even when they were already resolved in a meeting under a different identity. When
+  nothing matches but bare members remain, it returns a `hint` + `unresolvedMemberCount`
+  rather than a confidently-empty result.
+- **`list-chat-members` reads on the basic Teams token** (`ChatMember.Read`) instead of
+  the login-only elevated (M365ChatClient) token, so it no longer fails with "Elevated
+  token expired" on the command path. `next-page` routes `/chats/{id}/members` cursors on
+  the basic token to match. Chat _metadata_ (`list-chats` / `get-chat`) still requires
+  the elevated token.
+
 ## 1.5.1
 
 ### Fixed

package/dist/cli.js

@@ -2457,7 +2457,7 @@ import updateNotifier from "update-notifier";
 // package.json
 var package_default = {
   name: "ask-marcel-office-cli",
-  version: "1.5.1",
+  version: "1.5.2",
   description: "Microsoft Graph CLI + library — typed Bun/TypeScript wrapper around 150+ Graph operations (read + on-the-fly PDF/markdown conversion + federated Microsoft Search) reachable from a Teams browser-OAuth token.",
   license: "MIT",
   author: "Vincent Delacourt <vincent.delacourt@adama-development.com>",
@@ -3658,12 +3658,12 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
   };
   const recoverableElevatedFailureMessage = (reason) => {
     if (reason === "launch_timeout") {
-      return "elevated browser launch timed out (15s) — likely a corrupt persistent profile or filesystem lock. Run `ask-marcel logout && ask-marcel login` to wipe the profile and retry. (Commands that need this token: list-chats, get-chat, list-chat-members, the historical-version download / convert commands.)";
+      return "elevated browser launch timed out (15s) — likely a corrupt persistent profile or filesystem lock. Run `ask-marcel logout && ask-marcel login` to wipe the profile and retry. (Commands that need this token: list-chats, get-chat, the historical-version download / convert commands.)";
     }
     if (reason === "navigation_failed") {
-      return "elevated capture failed: navigation to m365.cloud.microsoft did not complete — network issue, corp-proxy block, or tenant policy. Check connectivity and retry. If persistent, the elevated commands (list-chats / get-chat / list-chat-members / historical-version downloads) will be unavailable.";
+      return "elevated capture failed: navigation to m365.cloud.microsoft did not complete — network issue, corp-proxy block, or tenant policy. Check connectivity and retry. If persistent, the elevated commands (list-chats / get-chat / historical-version downloads) will be unavailable.";
     }
-    return "elevated token capture timed out — silent SSO against m365.cloud.microsoft did not yield a Bearer within 20s. The persistent browser-profile cookies are likely expired. Run `ask-marcel logout && ask-marcel login` — this now wipes the profile too. (Commands that need this token: list-chats, get-chat, list-chat-members, the historical-version download / convert commands.)";
+    return "elevated token capture timed out — silent SSO against m365.cloud.microsoft did not yield a Bearer within 20s. The persistent browser-profile cookies are likely expired. Run `ask-marcel logout && ask-marcel login` — this now wipes the profile too. (Commands that need this token: list-chats, get-chat, the historical-version download / convert commands.)";
   };
   const recaptureElevated = async () => {
     try {
@@ -3699,7 +3699,7 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       return ok(validated.value);
     }
     if (!recaptureSecondaryViaBrowser)
-      return err({ type: "auth_failed", message: failFastSecondaryMessage("Elevated (M365)", "list-chats, get-chat, list-chat-members, download-drive-item-version") });
+      return err({ type: "auth_failed", message: failFastSecondaryMessage("Elevated (M365)", "list-chats, get-chat, download-drive-item-version") });
     return recaptureElevatedShared();
   };
   const freshChatsvcaggToken = (cached) => {
@@ -23014,7 +23014,7 @@ __export(exports_list_chat_members, {
 });
 var baseSchema21 = exports_external.object({ chatId: exports_external.string().min(1) });
 var CHAT_MEMBERS_ODATA_KEYS = ["skip", "select", "filter"];
-var inner5 = buildElevatedPickODataListCommand((p) => `/chats/${p.chatId}/members`, baseSchema21, CHAT_MEMBERS_ODATA_KEYS);
+var inner5 = buildPickODataListCommand((p) => `/chats/${p.chatId}/members`, baseSchema21, CHAT_MEMBERS_ODATA_KEYS);
 var execute42 = async (graph, params) => {
   const result = await inner5.execute(graph, params);
   if (result.ok)
@@ -23049,8 +23049,7 @@ var meta44 = {
   ],
   example: "ask-marcel list-chat-members --chat-id '19:abc...@thread.v2'",
   responseShape: "collection of Microsoft Graph `conversationMember` resources under `value[]`",
-  pagination: true,
-  needsElevatedToken: true
+  pagination: true
 };
 
 // src/use-cases/commands/list-drive-item-permissions.ts
@@ -24012,8 +24011,13 @@ __export(exports_next_page, {
   execute: () => execute74
 });
 var PREFIX = "https://graph.microsoft.com/v1.0";
-var ELEVATED_PATH_PREFIXES = ["/me/chats", "/chats/"];
-var requiresElevated = (path) => ELEVATED_PATH_PREFIXES.some((prefix) => path.startsWith(prefix));
+var requiresElevated = (path) => {
+  if (path.startsWith("/me/chats"))
+    return true;
+  if (path.startsWith("/chats/"))
+    return !path.includes("/members");
+  return false;
+};
 var schema74 = exports_external.object({
   url: exports_external.string().min(1).refine((v) => v.startsWith(`${PREFIX}/`), { message: `must be a Microsoft Graph v1.0 URL starting with ${PREFIX}/` })
 });
@@ -26631,15 +26635,43 @@ var projectMember = (m) => {
     out.userSubType = m.userSubType;
   return out;
 };
-var execute107 = async (graph, params) => {
-  const parsed = schema107.safeParse(params);
-  if (!parsed.success)
-    return err({ type: "validation_error", message: formatZodError(parsed.error) });
-  const queryFolded = fold(parsed.data.name);
-  const pageSize = parsed.data.pageSize ?? "100";
-  const maxPages = Number(parsed.data.maxPages ?? "10");
-  const matched = [];
-  const seenChatIds = new Set;
+var isNameResolvable = (m) => {
+  const fields = [m.displayName, m.email, m.userPrincipalName, m.givenName, m.surname];
+  return fields.some((f) => typeof f === "string" && f.trim() !== "");
+};
+var bareMemberCount = (members) => members.filter((m) => !isNameResolvable(m)).length;
+var fromGraphMember = (g) => ({
+  ...g.displayName !== undefined ? { displayName: g.displayName } : {},
+  ...g.email !== undefined ? { email: g.email } : {},
+  ...typeof g.userId === "string" ? { mri: `8:orgid:${g.userId}`, objectId: g.userId } : {}
+});
+var toMatchedChat = (chatId, chat, members) => ({
+  chatId,
+  title: chat.title ?? null,
+  chatType: chat.chatType,
+  threadType: chat.threadType,
+  memberCount: (chat.members ?? []).length,
+  ...chat.lastMessage?.composeTime !== undefined ? { lastMessageAt: chat.lastMessage.composeTime } : {},
+  matchedMembers: members.map(projectMember)
+});
+var collectChat = (chat, queryFolded, acc) => {
+  if (chat.id === undefined || acc.seen.has(chat.id))
+    return;
+  const members = chat.members ?? [];
+  const hits = members.filter((m) => memberMatches(m, queryFolded));
+  if (hits.length > 0) {
+    acc.seen.add(chat.id);
+    acc.matched.push(toMatchedChat(chat.id, chat, hits));
+    return;
+  }
+  const bareCount = bareMemberCount(members);
+  if (bareCount > 0) {
+    acc.seen.add(chat.id);
+    acc.bareUnmatched.push({ chatId: chat.id, chat, bareCount });
+  }
+};
+var scanChatPages = async (graph, queryFolded, pageSize, maxPages) => {
+  const acc = { seen: new Set, matched: [], bareUnmatched: [] };
   let continuationToken;
   let pagesFetched = 0;
   let chatsScanned = 0;
@@ -26654,42 +26686,67 @@ var execute107 = async (graph, params) => {
     const chats = body.chats ?? [];
     pagesFetched += 1;
     chatsScanned += chats.length;
-    for (const chat of chats) {
-      if (chat.id === undefined || seenChatIds.has(chat.id))
-        continue;
-      const members = chat.members ?? [];
-      const matchedMembers = members.filter((m) => memberMatches(m, queryFolded));
-      if (matchedMembers.length === 0)
-        continue;
-      seenChatIds.add(chat.id);
-      matched.push({
-        chatId: chat.id,
-        title: chat.title ?? null,
-        chatType: chat.chatType,
-        threadType: chat.threadType,
-        memberCount: members.length,
-        ...chat.lastMessage?.composeTime !== undefined ? { lastMessageAt: chat.lastMessage.composeTime } : {},
-        matchedMembers: matchedMembers.map(projectMember)
-      });
-    }
+    for (const chat of chats)
+      collectChat(chat, queryFolded, acc);
     if (body.hasMoreData !== true || body.continuationToken === undefined) {
       continuationToken = undefined;
       break;
     }
     continuationToken = body.continuationToken;
   }
+  return ok({ matched: acc.matched, bareUnmatched: acc.bareUnmatched, pagesFetched, chatsScanned, continuationToken });
+};
+var sumBareCounts = (bare) => bare.reduce((n, b) => n + b.bareCount, 0);
+var hydrateMatches = async (graph, chatId, queryFolded) => {
+  const res = await graph.get(`/chats/${chatId}/members`);
+  if (!res.ok)
+    return null;
+  const value = res.value.value ?? [];
+  return value.map(fromGraphMember).filter((m) => memberMatches(m, queryFolded));
+};
+var isDirectChat = (chatId) => chatId.endsWith("@unq.gbl.spaces");
+var hydrateBareDirect = async (graph, queryFolded, bareUnmatched, matched) => {
+  const direct = bareUnmatched.filter((b) => isDirectChat(b.chatId));
+  let unresolvedMemberCount = sumBareCounts(bareUnmatched.filter((b) => !isDirectChat(b.chatId)));
+  const results = await Promise.all(direct.map(async (b) => ({ bare: b, hits: await hydrateMatches(graph, b.chatId, queryFolded) })));
+  for (const { bare, hits } of results) {
+    if (hits === null) {
+      unresolvedMemberCount += bare.bareCount;
+      continue;
+    }
+    if (hits.length > 0)
+      matched.push(toMatchedChat(bare.chatId, bare.chat, hits));
+  }
+  return { chatsHydrated: direct.length, unresolvedMemberCount };
+};
+var HINT2 = "No chat member matched by name, but at least one chat has a cross-tenant member the Teams roster left unresolved — an externally-homed counterpart often appears only as a bare object-id. Direct 1:1 chats were deep-probed; members in group/meeting chats were not. Retry searching by their object-id (pass it as `--name <object-id>`), or, if you have the chat URL, read it directly with `get-chat` / `list-teams-chat-messages --chat-id 19:<their-oid>_<your-oid>@unq.gbl.spaces`.";
+var execute107 = async (graph, params) => {
+  const parsed = schema107.safeParse(params);
+  if (!parsed.success)
+    return err({ type: "validation_error", message: formatZodError(parsed.error) });
+  const queryFolded = fold(parsed.data.name);
+  const pageSize = parsed.data.pageSize ?? "100";
+  const maxPages = Number(parsed.data.maxPages ?? "20");
+  const scan = await scanChatPages(graph, queryFolded, pageSize, maxPages);
+  if (!scan.ok)
+    return scan;
+  const { matched, bareUnmatched, pagesFetched, chatsScanned, continuationToken } = scan.value;
+  const { chatsHydrated, unresolvedMemberCount } = await hydrateBareDirect(graph, queryFolded, bareUnmatched, matched);
   return ok({
     name: parsed.data.name,
     matches: matched,
     matchCount: matched.length,
     pagesFetched,
     chatsScanned,
+    chatsHydrated,
+    unresolvedMemberCount,
     hasMore: continuationToken !== undefined,
-    nextContinuationToken: continuationToken
+    nextContinuationToken: continuationToken,
+    ...matched.length === 0 && unresolvedMemberCount > 0 ? { hint: HINT2 } : {}
   });
 };
 var meta109 = {
-  summary: 'Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.',
+  summary: 'Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). Cross-tenant resolution: the summary roster returns externally-homed counterparts as a bare object-id (no name/email), which a name search cannot match; for every bare DIRECT (1:1) chat the command hydrates the roster via the per-chat members endpoint and re-matches — so an external counterpart who is bare in your 1:1 is still found, even when they were already resolved in some meeting (the dual-identity case). Bare members in group/meeting chats are not deep-probed; when nothing matches and such members exist it returns a `hint` plus `unresolvedMemberCount` rather than a confident empty result. **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.',
   category: "chats",
   needsSubstrateToken: true,
   graphMethod: "GET",
@@ -26706,7 +26763,7 @@ var meta109 = {
       name: "max-pages",
       key: "maxPages",
       required: false,
-      description: "Safety cap on the chat-list walk (positive integer; default 10). Each page returns up to `--page-size` chats. Raise carefully on busy accounts — every page is one HTTP round-trip."
+      description: "Safety cap on the chat-list walk (positive integer; default 20). The walk stops early once the substrate reports no more pages, so the cap only bites on accounts with more chats than `--max-pages × --page-size`; raise it (and watch `hasMore`) if a known chat is missed. Each page is one HTTP round-trip."
     },
     {
       name: "page-size",
@@ -26716,7 +26773,7 @@ var meta109 = {
     }
   ],
   example: "ask-marcel find-chats-with-user --name 'Jane DOE'",
-  responseShape: "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, hasMore, nextContinuationToken? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
+  responseShape: "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, chatsHydrated, unresolvedMemberCount, hasMore, nextContinuationToken?, hint? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `chatsHydrated` counts the per-chat members lookups spent resolving bare cross-tenant members in direct (1:1) chats. `unresolvedMemberCount` is how many cross-tenant members are still unresolved by name (bare members in group/meeting chats, which are not deep-probed, plus any 1:1 hydration that errored); when `matchCount` is 0 and this is non-zero, a `hint` is present explaining the likely cause and the object-id / read-by-chat-id remedy — so an empty result is never silently confident. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
   stability: "experimental"
 };
 

package/dist/commands.json

@@ -1,7 +1,7 @@
 {
   "package": "ask-marcel-office-cli",
-  "version": "1.5.1",
-  "generatedAt": "2026-06-22T01:10:59.323Z",
+  "version": "1.5.2",
+  "generatedAt": "2026-06-23T11:35:14.255Z",
   "commands": [
     {
       "name": "convert-calendar-event-attachment-to-markdown",
@@ -666,7 +666,7 @@
     },
     {
       "name": "find-chats-with-user",
-      "summary": "Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical \"all conversations with person X\" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.",
+      "summary": "Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical \"all conversations with person X\" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). Cross-tenant resolution: the summary roster returns externally-homed counterparts as a bare object-id (no name/email), which a name search cannot match; for every bare DIRECT (1:1) chat the command hydrates the roster via the per-chat members endpoint and re-matches — so an external counterpart who is bare in your 1:1 is still found, even when they were already resolved in some meeting (the dual-identity case). Bare members in group/meeting chats are not deep-probed; when nothing matches and such members exist it returns a `hint` plus `unresolvedMemberCount` rather than a confident empty result. **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.",
       "category": "chats",
       "graphMethod": "GET",
       "graphPathTemplate": "https://teams.microsoft.com/api/csa/{region}/api/v3/teams/users/me/chats",
@@ -682,7 +682,7 @@
           "name": "max-pages",
           "key": "maxPages",
           "required": false,
-          "description": "Safety cap on the chat-list walk (positive integer; default 10). Each page returns up to `--page-size` chats. Raise carefully on busy accounts — every page is one HTTP round-trip."
+          "description": "Safety cap on the chat-list walk (positive integer; default 20). The walk stops early once the substrate reports no more pages, so the cap only bites on accounts with more chats than `--max-pages × --page-size`; raise it (and watch `hasMore`) if a known chat is missed. Each page is one HTTP round-trip."
         },
         {
           "name": "page-size",
@@ -692,7 +692,7 @@
         }
       ],
       "example": "ask-marcel find-chats-with-user --name 'Jane DOE'",
-      "responseShape": "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, hasMore, nextContinuationToken? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
+      "responseShape": "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, chatsHydrated, unresolvedMemberCount, hasMore, nextContinuationToken?, hint? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `chatsHydrated` counts the per-chat members lookups spent resolving bare cross-tenant members in direct (1:1) chats. `unresolvedMemberCount` is how many cross-tenant members are still unresolved by name (bare members in group/meeting chats, which are not deep-probed, plus any 1:1 hydration that errored); when `matchCount` is 0 and this is non-zero, a `hint` is present explaining the likely cause and the object-id / read-by-chat-id remedy — so an empty result is never silently confident. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
       "needsSubstrateToken": true,
       "stability": "experimental"
     },
@@ -2987,8 +2987,7 @@
       ],
       "example": "ask-marcel list-chat-members --chat-id '19:abc...@thread.v2'",
       "responseShape": "collection of Microsoft Graph `conversationMember` resources under `value[]`",
-      "pagination": true,
-      "needsElevatedToken": true
+      "pagination": true
     },
     {
       "name": "list-chats",

package/dist/index.js

@@ -1432,12 +1432,12 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
   };
   const recoverableElevatedFailureMessage = (reason) => {
     if (reason === "launch_timeout") {
-      return "elevated browser launch timed out (15s) — likely a corrupt persistent profile or filesystem lock. Run `ask-marcel logout && ask-marcel login` to wipe the profile and retry. (Commands that need this token: list-chats, get-chat, list-chat-members, the historical-version download / convert commands.)";
+      return "elevated browser launch timed out (15s) — likely a corrupt persistent profile or filesystem lock. Run `ask-marcel logout && ask-marcel login` to wipe the profile and retry. (Commands that need this token: list-chats, get-chat, the historical-version download / convert commands.)";
     }
     if (reason === "navigation_failed") {
-      return "elevated capture failed: navigation to m365.cloud.microsoft did not complete — network issue, corp-proxy block, or tenant policy. Check connectivity and retry. If persistent, the elevated commands (list-chats / get-chat / list-chat-members / historical-version downloads) will be unavailable.";
+      return "elevated capture failed: navigation to m365.cloud.microsoft did not complete — network issue, corp-proxy block, or tenant policy. Check connectivity and retry. If persistent, the elevated commands (list-chats / get-chat / historical-version downloads) will be unavailable.";
     }
-    return "elevated token capture timed out — silent SSO against m365.cloud.microsoft did not yield a Bearer within 20s. The persistent browser-profile cookies are likely expired. Run `ask-marcel logout && ask-marcel login` — this now wipes the profile too. (Commands that need this token: list-chats, get-chat, list-chat-members, the historical-version download / convert commands.)";
+    return "elevated token capture timed out — silent SSO against m365.cloud.microsoft did not yield a Bearer within 20s. The persistent browser-profile cookies are likely expired. Run `ask-marcel logout && ask-marcel login` — this now wipes the profile too. (Commands that need this token: list-chats, get-chat, the historical-version download / convert commands.)";
   };
   const recaptureElevated = async () => {
     try {
@@ -1473,7 +1473,7 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       return ok(validated.value);
     }
     if (!recaptureSecondaryViaBrowser)
-      return err({ type: "auth_failed", message: failFastSecondaryMessage("Elevated (M365)", "list-chats, get-chat, list-chat-members, download-drive-item-version") });
+      return err({ type: "auth_failed", message: failFastSecondaryMessage("Elevated (M365)", "list-chats, get-chat, download-drive-item-version") });
     return recaptureElevatedShared();
   };
   const freshChatsvcaggToken = (cached) => {
@@ -19906,7 +19906,7 @@ __export(exports_list_chat_members, {
 });
 var baseSchema21 = exports_external.object({ chatId: exports_external.string().min(1) });
 var CHAT_MEMBERS_ODATA_KEYS = ["skip", "select", "filter"];
-var inner5 = buildElevatedPickODataListCommand((p) => `/chats/${p.chatId}/members`, baseSchema21, CHAT_MEMBERS_ODATA_KEYS);
+var inner5 = buildPickODataListCommand((p) => `/chats/${p.chatId}/members`, baseSchema21, CHAT_MEMBERS_ODATA_KEYS);
 var execute42 = async (graph, params) => {
   const result = await inner5.execute(graph, params);
   if (result.ok)
@@ -19941,8 +19941,7 @@ var meta44 = {
   ],
   example: "ask-marcel list-chat-members --chat-id '19:abc...@thread.v2'",
   responseShape: "collection of Microsoft Graph `conversationMember` resources under `value[]`",
-  pagination: true,
-  needsElevatedToken: true
+  pagination: true
 };
 
 // src/use-cases/commands/list-drive-item-permissions.ts
@@ -20904,8 +20903,13 @@ __export(exports_next_page, {
   execute: () => execute74
 });
 var PREFIX = "https://graph.microsoft.com/v1.0";
-var ELEVATED_PATH_PREFIXES = ["/me/chats", "/chats/"];
-var requiresElevated = (path) => ELEVATED_PATH_PREFIXES.some((prefix) => path.startsWith(prefix));
+var requiresElevated = (path) => {
+  if (path.startsWith("/me/chats"))
+    return true;
+  if (path.startsWith("/chats/"))
+    return !path.includes("/members");
+  return false;
+};
 var schema74 = exports_external.object({
   url: exports_external.string().min(1).refine((v) => v.startsWith(`${PREFIX}/`), { message: `must be a Microsoft Graph v1.0 URL starting with ${PREFIX}/` })
 });
@@ -23523,15 +23527,43 @@ var projectMember = (m) => {
     out.userSubType = m.userSubType;
   return out;
 };
-var execute107 = async (graph, params) => {
-  const parsed = schema107.safeParse(params);
-  if (!parsed.success)
-    return err({ type: "validation_error", message: formatZodError(parsed.error) });
-  const queryFolded = fold(parsed.data.name);
-  const pageSize = parsed.data.pageSize ?? "100";
-  const maxPages = Number(parsed.data.maxPages ?? "10");
-  const matched = [];
-  const seenChatIds = new Set;
+var isNameResolvable = (m) => {
+  const fields = [m.displayName, m.email, m.userPrincipalName, m.givenName, m.surname];
+  return fields.some((f) => typeof f === "string" && f.trim() !== "");
+};
+var bareMemberCount = (members) => members.filter((m) => !isNameResolvable(m)).length;
+var fromGraphMember = (g) => ({
+  ...g.displayName !== undefined ? { displayName: g.displayName } : {},
+  ...g.email !== undefined ? { email: g.email } : {},
+  ...typeof g.userId === "string" ? { mri: `8:orgid:${g.userId}`, objectId: g.userId } : {}
+});
+var toMatchedChat = (chatId, chat, members) => ({
+  chatId,
+  title: chat.title ?? null,
+  chatType: chat.chatType,
+  threadType: chat.threadType,
+  memberCount: (chat.members ?? []).length,
+  ...chat.lastMessage?.composeTime !== undefined ? { lastMessageAt: chat.lastMessage.composeTime } : {},
+  matchedMembers: members.map(projectMember)
+});
+var collectChat = (chat, queryFolded, acc) => {
+  if (chat.id === undefined || acc.seen.has(chat.id))
+    return;
+  const members = chat.members ?? [];
+  const hits = members.filter((m) => memberMatches(m, queryFolded));
+  if (hits.length > 0) {
+    acc.seen.add(chat.id);
+    acc.matched.push(toMatchedChat(chat.id, chat, hits));
+    return;
+  }
+  const bareCount = bareMemberCount(members);
+  if (bareCount > 0) {
+    acc.seen.add(chat.id);
+    acc.bareUnmatched.push({ chatId: chat.id, chat, bareCount });
+  }
+};
+var scanChatPages = async (graph, queryFolded, pageSize, maxPages) => {
+  const acc = { seen: new Set, matched: [], bareUnmatched: [] };
   let continuationToken;
   let pagesFetched = 0;
   let chatsScanned = 0;
@@ -23546,42 +23578,67 @@ var execute107 = async (graph, params) => {
     const chats = body.chats ?? [];
     pagesFetched += 1;
     chatsScanned += chats.length;
-    for (const chat of chats) {
-      if (chat.id === undefined || seenChatIds.has(chat.id))
-        continue;
-      const members = chat.members ?? [];
-      const matchedMembers = members.filter((m) => memberMatches(m, queryFolded));
-      if (matchedMembers.length === 0)
-        continue;
-      seenChatIds.add(chat.id);
-      matched.push({
-        chatId: chat.id,
-        title: chat.title ?? null,
-        chatType: chat.chatType,
-        threadType: chat.threadType,
-        memberCount: members.length,
-        ...chat.lastMessage?.composeTime !== undefined ? { lastMessageAt: chat.lastMessage.composeTime } : {},
-        matchedMembers: matchedMembers.map(projectMember)
-      });
-    }
+    for (const chat of chats)
+      collectChat(chat, queryFolded, acc);
     if (body.hasMoreData !== true || body.continuationToken === undefined) {
       continuationToken = undefined;
       break;
     }
     continuationToken = body.continuationToken;
   }
+  return ok({ matched: acc.matched, bareUnmatched: acc.bareUnmatched, pagesFetched, chatsScanned, continuationToken });
+};
+var sumBareCounts = (bare) => bare.reduce((n, b) => n + b.bareCount, 0);
+var hydrateMatches = async (graph, chatId, queryFolded) => {
+  const res = await graph.get(`/chats/${chatId}/members`);
+  if (!res.ok)
+    return null;
+  const value = res.value.value ?? [];
+  return value.map(fromGraphMember).filter((m) => memberMatches(m, queryFolded));
+};
+var isDirectChat = (chatId) => chatId.endsWith("@unq.gbl.spaces");
+var hydrateBareDirect = async (graph, queryFolded, bareUnmatched, matched) => {
+  const direct = bareUnmatched.filter((b) => isDirectChat(b.chatId));
+  let unresolvedMemberCount = sumBareCounts(bareUnmatched.filter((b) => !isDirectChat(b.chatId)));
+  const results = await Promise.all(direct.map(async (b) => ({ bare: b, hits: await hydrateMatches(graph, b.chatId, queryFolded) })));
+  for (const { bare, hits } of results) {
+    if (hits === null) {
+      unresolvedMemberCount += bare.bareCount;
+      continue;
+    }
+    if (hits.length > 0)
+      matched.push(toMatchedChat(bare.chatId, bare.chat, hits));
+  }
+  return { chatsHydrated: direct.length, unresolvedMemberCount };
+};
+var HINT2 = "No chat member matched by name, but at least one chat has a cross-tenant member the Teams roster left unresolved — an externally-homed counterpart often appears only as a bare object-id. Direct 1:1 chats were deep-probed; members in group/meeting chats were not. Retry searching by their object-id (pass it as `--name <object-id>`), or, if you have the chat URL, read it directly with `get-chat` / `list-teams-chat-messages --chat-id 19:<their-oid>_<your-oid>@unq.gbl.spaces`.";
+var execute107 = async (graph, params) => {
+  const parsed = schema107.safeParse(params);
+  if (!parsed.success)
+    return err({ type: "validation_error", message: formatZodError(parsed.error) });
+  const queryFolded = fold(parsed.data.name);
+  const pageSize = parsed.data.pageSize ?? "100";
+  const maxPages = Number(parsed.data.maxPages ?? "20");
+  const scan = await scanChatPages(graph, queryFolded, pageSize, maxPages);
+  if (!scan.ok)
+    return scan;
+  const { matched, bareUnmatched, pagesFetched, chatsScanned, continuationToken } = scan.value;
+  const { chatsHydrated, unresolvedMemberCount } = await hydrateBareDirect(graph, queryFolded, bareUnmatched, matched);
   return ok({
     name: parsed.data.name,
     matches: matched,
     matchCount: matched.length,
     pagesFetched,
     chatsScanned,
+    chatsHydrated,
+    unresolvedMemberCount,
     hasMore: continuationToken !== undefined,
-    nextContinuationToken: continuationToken
+    nextContinuationToken: continuationToken,
+    ...matched.length === 0 && unresolvedMemberCount > 0 ? { hint: HINT2 } : {}
   });
 };
 var meta109 = {
-  summary: 'Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.',
+  summary: 'Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). Cross-tenant resolution: the summary roster returns externally-homed counterparts as a bare object-id (no name/email), which a name search cannot match; for every bare DIRECT (1:1) chat the command hydrates the roster via the per-chat members endpoint and re-matches — so an external counterpart who is bare in your 1:1 is still found, even when they were already resolved in some meeting (the dual-identity case). Bare members in group/meeting chats are not deep-probed; when nothing matches and such members exist it returns a `hint` plus `unresolvedMemberCount` rather than a confident empty result. **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.',
   category: "chats",
   needsSubstrateToken: true,
   graphMethod: "GET",
@@ -23598,7 +23655,7 @@ var meta109 = {
       name: "max-pages",
       key: "maxPages",
       required: false,
-      description: "Safety cap on the chat-list walk (positive integer; default 10). Each page returns up to `--page-size` chats. Raise carefully on busy accounts — every page is one HTTP round-trip."
+      description: "Safety cap on the chat-list walk (positive integer; default 20). The walk stops early once the substrate reports no more pages, so the cap only bites on accounts with more chats than `--max-pages × --page-size`; raise it (and watch `hasMore`) if a known chat is missed. Each page is one HTTP round-trip."
     },
     {
       name: "page-size",
@@ -23608,7 +23665,7 @@ var meta109 = {
     }
   ],
   example: "ask-marcel find-chats-with-user --name 'Jane DOE'",
-  responseShape: "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, hasMore, nextContinuationToken? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
+  responseShape: "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, chatsHydrated, unresolvedMemberCount, hasMore, nextContinuationToken?, hint? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `chatsHydrated` counts the per-chat members lookups spent resolving bare cross-tenant members in direct (1:1) chats. `unresolvedMemberCount` is how many cross-tenant members are still unresolved by name (bare members in group/meeting chats, which are not deep-probed, plus any 1:1 hydration that errored); when `matchCount` is 0 and this is non-zero, a `hint` is present explaining the likely cause and the object-id / read-by-chat-id remedy — so an empty result is never silently confident. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
   stability: "experimental"
 };
 

package/docs/COMMANDS.md

@@ -223,7 +223,7 @@ For everything else:
 
 | Command | Description | Required params | Graph endpoint |
 |---------|-------------|-----------------|----------------|
-| `find-chats-with-user` | Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API. | `--name`, `--max-pages`, `--page-size` | `GET https://teams.microsoft.com/api/csa/{region}/api/v3/teams/users/me/chats` |
+| `find-chats-with-user` | Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). Cross-tenant resolution: the summary roster returns externally-homed counterparts as a bare object-id (no name/email), which a name search cannot match; for every bare DIRECT (1:1) chat the command hydrates the roster via the per-chat members endpoint and re-matches — so an external counterpart who is bare in your 1:1 is still found, even when they were already resolved in some meeting (the dual-identity case). Bare members in group/meeting chats are not deep-probed; when nothing matches and such members exist it returns a `hint` plus `unresolvedMemberCount` rather than a confident empty result. **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API. | `--name`, `--max-pages`, `--page-size` | `GET https://teams.microsoft.com/api/csa/{region}/api/v3/teams/users/me/chats` |
 | `get-chat` | Return metadata for a single Microsoft Teams chat (1:1, group, or meeting). The CLI ships a slim default `--select=id,topic,chatType,createdDateTime,lastUpdatedDateTime`; pass `--select id,topic,webUrl,onlineMeetingInfo` (or any other comma-separated field list) to widen. Pass `--expand members` to inline membership. Returns metadata only — not the messages (which need `Chat.Read*`). Requires the M365ChatClient elevated token captured at login (the basic Teams web client token lacks `Chat.ReadBasic`). | `--chat-id`, `--select`, `--expand` | `GET /chats/{chat-id}` |
 | `get-teams-chat-message` | Return a single Microsoft Teams chat message by its id via the chat substrate. Uses the chatsvcagg-audience bearer captured at login (same identity as the basic Teams token, different audience). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API. Source the chat-id + message-id via `list-teams-chats-with-messages` or `list-teams-chat-messages`. | `--chat-id`, `--message-id` | `GET https://teams.microsoft.com/api/csa/{region}/api/v1/chats/{chat-id}/messages/{message-id}` |
 | `list-chat-members` | List the members of a single Microsoft Teams chat. Graph rejects `$top` / `$orderby` / `$expand` on this endpoint, so the CLI advertises only the subset Graph honours (`--skip`, `--select`, `--filter`). | `--chat-id`, `--skip`, `--select`, `--filter` | `GET /chats/{chat-id}/members` |

package/docs/commands.json

@@ -1,7 +1,7 @@
 {
   "package": "ask-marcel-office-cli",
-  "version": "1.5.1",
-  "generatedAt": "2026-06-22T01:10:59.323Z",
+  "version": "1.5.2",
+  "generatedAt": "2026-06-23T11:35:14.255Z",
   "commands": [
     {
       "name": "convert-calendar-event-attachment-to-markdown",
@@ -666,7 +666,7 @@
     },
     {
       "name": "find-chats-with-user",
-      "summary": "Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical \"all conversations with person X\" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.",
+      "summary": "Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Jane` matches `Jane DOE` AND `jane.doe@example.com` AND `JANE` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical \"all conversations with person X\" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). Cross-tenant resolution: the summary roster returns externally-homed counterparts as a bare object-id (no name/email), which a name search cannot match; for every bare DIRECT (1:1) chat the command hydrates the roster via the per-chat members endpoint and re-matches — so an external counterpart who is bare in your 1:1 is still found, even when they were already resolved in some meeting (the dual-identity case). Bare members in group/meeting chats are not deep-probed; when nothing matches and such members exist it returns a `hint` plus `unresolvedMemberCount` rather than a confident empty result. **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.",
       "category": "chats",
       "graphMethod": "GET",
       "graphPathTemplate": "https://teams.microsoft.com/api/csa/{region}/api/v3/teams/users/me/chats",
@@ -682,7 +682,7 @@
           "name": "max-pages",
           "key": "maxPages",
           "required": false,
-          "description": "Safety cap on the chat-list walk (positive integer; default 10). Each page returns up to `--page-size` chats. Raise carefully on busy accounts — every page is one HTTP round-trip."
+          "description": "Safety cap on the chat-list walk (positive integer; default 20). The walk stops early once the substrate reports no more pages, so the cap only bites on accounts with more chats than `--max-pages × --page-size`; raise it (and watch `hasMore`) if a known chat is missed. Each page is one HTTP round-trip."
         },
         {
           "name": "page-size",
@@ -692,7 +692,7 @@
         }
       ],
       "example": "ask-marcel find-chats-with-user --name 'Jane DOE'",
-      "responseShape": "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, hasMore, nextContinuationToken? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
+      "responseShape": "`{ name, matches: [{ chatId, title, chatType, threadType, memberCount, lastMessageAt?, matchedMembers: [{ mri, displayName, email, userSubType }] }], matchCount, pagesFetched, chatsScanned, chatsHydrated, unresolvedMemberCount, hasMore, nextContinuationToken?, hint? }`. `matchedMembers` always carries the matching entries' identifying fields — pass `chatId` into `list-teams-chat-history` to read message bodies. `chatsHydrated` counts the per-chat members lookups spent resolving bare cross-tenant members in direct (1:1) chats. `unresolvedMemberCount` is how many cross-tenant members are still unresolved by name (bare members in group/meeting chats, which are not deep-probed, plus any 1:1 hydration that errored); when `matchCount` is 0 and this is non-zero, a `hint` is present explaining the likely cause and the object-id / read-by-chat-id remedy — so an empty result is never silently confident. `hasMore: true` means `--max-pages` was hit before exhausting the chat list; chain with the existing `--continuation-token` flag on `list-teams-chats-with-messages` if you need to scan further (this command does not advertise a `--continuation-token` because resuming a partial search is rare; users either widen `--max-pages` or refine `--name`).",
       "needsSubstrateToken": true,
       "stability": "experimental"
     },
@@ -2987,8 +2987,7 @@
       ],
       "example": "ask-marcel list-chat-members --chat-id '19:abc...@thread.v2'",
       "responseShape": "collection of Microsoft Graph `conversationMember` resources under `value[]`",
-      "pagination": true,
-      "needsElevatedToken": true
+      "pagination": true
     },
     {
       "name": "list-chats",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ask-marcel-office-cli",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "Microsoft Graph CLI + library \u2014 typed Bun/TypeScript wrapper around 150+ Graph operations (read + on-the-fly PDF/markdown conversion + federated Microsoft Search) reachable from a Teams browser-OAuth token.",
   "license": "MIT",
   "author": "Vincent Delacourt <vincent.delacourt@adama-development.com>",