comisai 1.0.45 → 1.0.46

package/node_modules/@comis/daemon/dist/wiring/setup-channels/setup-channels-runtime.js

@@ -53,7 +53,7 @@ export async function buildAndStartChannelManager(deps) {
                 maxTextLength: ttsConfig.maxTextLength,
                 outputFormats: ttsConfig.outputFormats,
                 providerFormatKey,
-                provider: ttsConfig.provider, // OBS-01 §2.7 voice-identity (INFO line)
+                provider: ttsConfig.provider, // §2.7 voice-identity (INFO line)
                 keyless: ttsConfig.provider === "edge" || ttsConfig.provider === "local", // edge/local ⇒ $0
                 ...(ttsConfig.model !== undefined ? { model: ttsConfig.model } : {}),
             },
@@ -77,11 +77,10 @@ export async function buildAndStartChannelManager(deps) {
     // coordinatorFactory can close over it (markers from the default agent activity.theme).
     const activityMarkers = themeForName(agents[defaultAgentId]?.activity?.theme ?? "default").markers;
     const activityRenderers = buildActivityRenderers(adaptersByType, channelPlugins, channelsLogger, { timer: deps.timers, clock: deps.clock, signCallbackData: deps.signCallbackData, mintApprovalLink: deps.mintApprovalLink, markers: activityMarkers });
-    // The SOLE renderer-injection point is the per-turn `deps.activityRendererFactory?.(ctx.channelType)`
-    // fallback in the coordinatorFactory below — fires for any channelType the live map does not serve (test-only seam).
+    // The SOLE renderer-injection point is the per-turn `deps.activityRendererFactory?.(ctx.channelType)` fallback in the coordinatorFactory below — fires for any channelType the live map does not serve (test-only seam).
     // The per-turn coordinatorFactory the inbound pipeline gate (execution-pipeline.ts:395) needs — over
     // renderers + redacted ActivityStream + breaker + live kill-switch. Built ONLY when stream is injected (absent → gate
-    // false, fail-closed §22.2). Closure lives in the daemon (root importing @comis/orchestrator + observability — Pitfall 1).
+    // false, fail-closed §22.2). Closure lives in the daemon (root importing @comis/orchestrator + observability).
     const activityStream = deps.activityStream;
     // Build the SEP plan-stream ONCE outside the per-turn closure. SHARED across turns;
     // per-turn (agentId, sessionKey) filter inside the coordinator prevents cross-turn snapshot leaks.
@@ -110,6 +109,7 @@ export async function buildAndStartChannelManager(deps) {
                 killSwitch: () => resolveActivityKillSwitchSlice(agents, ctx.agentId),
                 breaker: deps.activityBreaker, // process-singleton (shared across coordinators)
                 planStream, // shared SEP plan-stream (built ONCE outside the closure)
+                eventBus: container.eventBus, // the activity:turn_finalized user-surface emit
             });
         }
         : undefined;
@@ -311,7 +311,7 @@ export async function buildAndStartChannelManager(deps) {
                         maxSteps: execAgentConfig?.maxSteps ?? 10,
                     }),
                     destroySession: (key) => {
-                        // Complete three-layer forget when wired (live 2026-06-11); legacy runtime-only destroy otherwise.
+                        // Complete three-layer forget when wired; legacy runtime-only destroy otherwise.
                         const adapter = deps.piSessionAdapters?.get(agentId);
                         if (deps.destroyConversation) {
                             // eslint-disable-next-line no-restricted-syntax -- intentional fire-and-forget

package/node_modules/@comis/daemon/dist/wiring/setup-channels/setup-channels-skill-synthesis-deps.d.ts

@@ -1,6 +1,5 @@
 /**
- * Assemble the closed-graph REFLECTION injectables (v2.31 Reflection, Phase 223
- * Plan 05, REFLECT-01/02) for the `__REFLECT__` cron sentinel — the
+ * Assemble the closed-graph REFLECTION injectables for the `__REFLECT__` cron sentinel — the
  * reflect-engine replacement for the deleted `buildSkillSynthesisCronDeps`
  * embedding-clustering bundle.
  *
@@ -15,21 +14,21 @@
  * OFF by default the sentinel short-circuits ok BEFORE it ever reads this bundle,
  * so a default install never exercises this path.
  *
- * What CHANGED from the synthesis bundle (D-07 / I1 — delete, don't wrap):
+ * What CHANGED from the synthesis bundle (delete, don't wrap):
  * - REMOVED the clustering embedding wiring (the embed-attach helper, its char cap,
  *   and the embedding port field). The reflection job groups by
  *   `normalizeOpeningRequest(signature)` — a deterministic, keyless topicKey (NO
- *   embeddings, so the SYNTH-EMBED-DEAD singleton failure is gone).
+ *   embeddings, so the embedding-singleton failure mode is gone).
  * - REMOVED the user-system-context strip here — its envelope-stripping algorithm
- *   now lives in Plan 01's topic-key.ts (the group-by key normalizer); this builder
+ *   now lives in topic-key.ts (the group-by key normalizer); this builder
  *   passes the raw user-role text through as `signature` and the job normalizes it.
  * - REMOVED the sandbox validation adapter + the mutating-approval gate — an
- *   advisory doc carries NO executable surface (Phase 222 dropped the column), so
+ *   advisory doc carries NO executable surface (the advisory-doc column was dropped), so
  *   the only validation is the STATIC `validateLearnedDocBody` keystone the JOB
- *   runs (INV-3). Removing the gate removes an attack surface (INV-3 strengthened).
- * - ADDED a per-source `trustedOrigin` (INV-5/D-04) the job FILTERS on — derived
+ *   runs. Removing the gate removes an attack surface.
+ * - ADDED a per-source `trustedOrigin` the job FILTERS on — derived
  *   DAEMON-SIDE here (the daemon has the session/sender-trust context; the
- *   `ResolvedOutcome` does NOT carry it — Research A2).
+ *   `ResolvedOutcome` does NOT carry it).
  *
  * @module
  */
@@ -50,7 +49,7 @@ export interface ReflectionDepsInput {
     learnedSkillStore?: MentalModelStorePort;
     /**
      * The high-trust SOURCE-MEMORY read surface the PROFILE/TOPIC source builders distil
-     * over (Phase 225 FOLD — the old user-rep/consolidation `memoryApi.inspect` read). The
+     * over (the old user-rep/consolidation `memoryApi.inspect` read). The
      * SKILL builder does not use it (it reads outcome trajectories). Absent ⇒ the profile/
      * topic builders return empty (fail-closed — never fabricate a profile/topic source).
      */

package/node_modules/@comis/daemon/dist/wiring/setup-channels/setup-channels-skill-synthesis-deps.js

@@ -1,7 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Assemble the closed-graph REFLECTION injectables (v2.31 Reflection, Phase 223
- * Plan 05, REFLECT-01/02) for the `__REFLECT__` cron sentinel — the
+ * Assemble the closed-graph REFLECTION injectables for the `__REFLECT__` cron sentinel — the
  * reflect-engine replacement for the deleted `buildSkillSynthesisCronDeps`
  * embedding-clustering bundle.
  *
@@ -16,21 +15,21 @@
  * OFF by default the sentinel short-circuits ok BEFORE it ever reads this bundle,
  * so a default install never exercises this path.
  *
- * What CHANGED from the synthesis bundle (D-07 / I1 — delete, don't wrap):
+ * What CHANGED from the synthesis bundle (delete, don't wrap):
  * - REMOVED the clustering embedding wiring (the embed-attach helper, its char cap,
  *   and the embedding port field). The reflection job groups by
  *   `normalizeOpeningRequest(signature)` — a deterministic, keyless topicKey (NO
- *   embeddings, so the SYNTH-EMBED-DEAD singleton failure is gone).
+ *   embeddings, so the embedding-singleton failure mode is gone).
  * - REMOVED the user-system-context strip here — its envelope-stripping algorithm
- *   now lives in Plan 01's topic-key.ts (the group-by key normalizer); this builder
+ *   now lives in topic-key.ts (the group-by key normalizer); this builder
  *   passes the raw user-role text through as `signature` and the job normalizes it.
  * - REMOVED the sandbox validation adapter + the mutating-approval gate — an
- *   advisory doc carries NO executable surface (Phase 222 dropped the column), so
+ *   advisory doc carries NO executable surface (the advisory-doc column was dropped), so
  *   the only validation is the STATIC `validateLearnedDocBody` keystone the JOB
- *   runs (INV-3). Removing the gate removes an attack surface (INV-3 strengthened).
- * - ADDED a per-source `trustedOrigin` (INV-5/D-04) the job FILTERS on — derived
+ *   runs. Removing the gate removes an attack surface.
+ * - ADDED a per-source `trustedOrigin` the job FILTERS on — derived
  *   DAEMON-SIDE here (the daemon has the session/sender-trust context; the
- *   `ResolvedOutcome` does NOT carry it — Research A2).
+ *   `ResolvedOutcome` does NOT carry it).
  *
  * @module
  */
@@ -39,23 +38,23 @@ import { buildReviewSessionSource } from "./review-session-source.js";
  * The untrusted-tier label every UNKNOWN/unmapped sender resolves to — the
  * `ElevatedReplyConfigSchema.defaultTrustLevel` default (schema-agent-prompt.ts)
  * and the memory `TrustLevel` external tier. A sender whose derived tier equals
- * this is NOT a trusted origin (INV-5/D-04). Mirrors the delivery-service
+ * this is NOT a trusted origin. Mirrors the delivery-service
  * "unmapped participant ⇒ external (inert)" classification.
  */
 const UNTRUSTED_TRUST_TIER = "external";
 /**
- * Derive whether a session-source sender is a TRUSTED origin (INV-5/D-04), reading
+ * Derive whether a session-source sender is a TRUSTED origin, reading
  * the per-agent `elevatedReply.senderTrustMap` (senderId -> trust-tier name) with
  * the configured `defaultTrustLevel` (schema default `"external"`) for an unmapped
  * sender. A sender resolving to the `"external"` tier is NOT trusted.
  *
- * DENY-ON-UNKNOWN (M-1/INV-5): when trust CANNOT be positively established — no
+ * DENY-ON-UNKNOWN: when trust CANNOT be positively established — no
  * sender id, no `senderTrustMap` entry, and the default is the `"external"` tier —
  * the result is `false`. NEVER default to trusted: an untrusted/unknown-origin
  * success must seed nothing (a deny-default merely UNDER-seeds — under-learning is
- * benign; an allow-default would silently weaken INV-5 by letting a planted
+ * benign; an allow-default would silently weaken this invariant by letting a planted
  * unknown-origin success corroborate a doc). The JOB enforces the filter
- * (reflection-job.ts SELECT, RED both directions in Plan 04); this is the daemon
+ * (reflection-job.ts SELECT); this is the daemon
  * DERIVATION that feeds it.
  */
 function deriveTrustedOrigin(sender, senderTrustMap, defaultTrustLevel) {
@@ -79,10 +78,10 @@ export function buildReflectionCronDeps(deps) {
     return {
         learnedSkillStore,
         outcomeSignal: outcomeStore,
-        // Build the PER-KIND source trajectories for the reflection SELECT step (Phase 225
-        // FOLD — the daemon-side `kind` seam). SKILL reflects over OUTCOME trajectories;
+        // Build the PER-KIND source trajectories for the reflection SELECT step (the
+        // daemon-side `kind` seam). SKILL reflects over OUTCOME trajectories;
         // PROFILE/TOPIC reflect over high-trust SOURCE MEMORIES (the old user-rep/consolidation
-        // corpus). Both carry BOTH FOLD-04 anti-poison axes the job filters on.
+        // corpus). Both carry BOTH anti-poison axes the job filters on.
         buildSourceTrajectories: async (kind, agentId, tenantId) => {
             if (kind === "skill")
                 return buildSkillSources(deps, outcomeStore, agentId, tenantId);
@@ -95,8 +94,8 @@ export function buildReflectionCronDeps(deps) {
  * attaching each turn's LCD-merged session transcript (buildReviewSessionSource — NOT raw
  * listDetailed which is empty in DAG mode) as the text to generalize from. The reflection
  * SELECT resolves each `trajectoryId` against the outcome signal — outcomes are keyed by the
- * PER-TURN `traceId` (setup-learning.ts), NOT the sessionKey. Pre-fix this emitted the
- * sessionKey, which resolve() never matched → `selected:0` forever (live VPS 2026-06-18).
+ * PER-TURN `traceId` (setup-learning.ts), NOT the sessionKey. Emitting the
+ * sessionKey instead would never match resolve() → `selected:0` forever.
  */
 async function buildSkillSources(deps, outcomeStore, agentId, tenantId) {
     // Fail-closed: without an enumerable, resolvable id source there is nothing to
@@ -118,7 +117,7 @@ async function buildSkillSources(deps, outcomeStore, agentId, tenantId) {
     const senderBySession = new Map();
     for (const e of source.listDetailed(tenantId))
         senderBySession.set(e.sessionKey, e.userId);
-    // INV-5/D-04: the per-agent trust derivation inputs (elevatedReply.senderTrustMap
+    // The per-agent trust derivation inputs (elevatedReply.senderTrustMap
     // + defaultTrustLevel). Read once per run. The config is always default-parsed
     // (schema-agent-runtime.ts:377), so an agent that never configured elevatedReply
     // gets `{}` + `"external"` ⇒ every unmapped sender is deny-on-unknown.
@@ -147,7 +146,7 @@ async function buildSkillSources(deps, outcomeStore, agentId, tenantId) {
             // The topicKey signature = the user-role messages (the task INTENT the user
             // controls), which is stable across the agent's response wording. The JOB
             // normalizes it via normalizeOpeningRequest (topic-key.ts) — which also
-            // strips the volatile executor envelope (the RC-2 [System context] header),
+            // strips the volatile executor envelope (the [System context] header),
             // so identical requests at different times collapse to the same topicKey.
             // Fall back to the full text when a session has no user message (so the
             // signature is never empty).
@@ -163,45 +162,53 @@ async function buildSkillSources(deps, outcomeStore, agentId, tenantId) {
         return val;
     };
     const out = [];
-    for (const { trajectoryId, sessionId } of idsRes.value) {
+    for (const { trajectoryId, sessionId, procedureDescriptor: descriptor } of idsRes.value) {
         const texts = sessionTexts(sessionId);
         if (texts === undefined)
             continue; // no transcript for this turn's session → skip
         const sender = senderBySession.get(sessionId) ?? "";
+        // The content-free procedure descriptor read back from listTrajectoryIds (the ordered
+        // tool-NAME sequence + counts). The KEY is the ordered sequence JOINED — order + repeats
+        // preserved, NOT sorted/deduped (the sequence + counts contract). It is self-sufficient
+        // because a custom procedure groupKey BYPASSES the Jaccard signature-merge (only
+        // byte-identical keys collide). The tool method names never contain `>`, so the separator
+        // is injective. Absent (empty) ⇒ omit — the turn ran no cap-mapped tool call sites.
+        const sequence = descriptor ?? [];
         out.push({
             trajectoryId,
             sessionId,
             sender,
             text: texts.text,
             signature: texts.signature,
-            // FOLD-04 AXIS 1 (INV-5/D-04): derive SESSION-origin trust DAEMON-SIDE
+            // Trust axis 1: derive SESSION-origin trust DAEMON-SIDE
             // (deny-on-unknown). The job filters on it.
             trustedOrigin: deriveTrustedOrigin(sender, senderTrustMap, defaultTrustLevel),
-            // FOLD-04 AXIS 2 (Phase 225): the per-MEMORY source-trust axis is always
+            // Trust axis 2: the per-MEMORY source-trust axis is always
             // false for kind:skill — a skill source is an OUTCOME trajectory (a finished
             // session), NOT a source memory carrying a per-memory trustLevel.
             sourceTrustExternal: false,
+            ...(sequence.length > 0 ? { procedureDescriptor: { key: sequence.join(">"), sequence } } : {}),
         });
     }
     return out;
 }
 /**
- * PROFILE / TOPIC kinds (Phase 225 FOLD-04 daemon side, axis 2): build sources from the
+ * PROFILE / TOPIC kinds (daemon side, axis 2): build sources from the
  * agent's high-trust SOURCE MEMORIES (the corpus the old user-rep/consolidation jobs read
  * via `memoryApi.inspect`), NOT outcome trajectories. For EACH source memory we set:
  *
- *  - `sourceTrustExternal = (trustLevel === "external")` — the load-bearing FOLD-04 axis 2,
+ *  - `sourceTrustExternal = (trustLevel === "external")` — the load-bearing axis 2,
  *    the OLD user-rep layer-1 firewall (memory-user-representation-job.ts:322
  *    `s.trustLevel !== "external"`). A planted `external`-trust memory rides through with
- *    `sourceTrustExternal:true`; Plan 01's engine SELECT then excludes it EVEN on a trusted
- *    session (the two axes compose — Pitfall 2). The exclude lives in the JOB (one
+ *    `sourceTrustExternal:true`; the engine SELECT then excludes it EVEN on a trusted
+ *    session (the two axes compose). The exclude lives in the JOB (one
  *    authoritative layer), this is the daemon DERIVATION feeding it.
  *  - `trustedOrigin: true` — a high-trust (system/learned) source memory IS the trusted
  *    corpus (the old user-rep semantics: the per-MEMORY external exclude is the firewall,
  *    not a per-session origin check). An `external` source carries `trustedOrigin:true` too
  *    but is excluded by axis 2 regardless — proving the axes are distinct.
  *  - PROFILE: `sender = userId` so the engine's profile `groupKey: (t) => t.sender` yields
- *    `topicKey === userId` (one doc per user, which Plan 02's `<user_profile>` read selects
+ *    `topicKey === userId` (one doc per user, which the `<user_profile>` read selects
  *    on); the `signature` carries the userId so distinct users never collapse into one group.
  *  - TOPIC: groups like skill via the engine's default `normalizeOpeningRequest(signature)`,
  *    so the `signature` is the memory content (the cluster's representative text).
@@ -246,7 +253,7 @@ function buildMemorySources(deps, kind, agentId, tenantId) {
                 // The high-trust source corpus is the trusted origin (the old user-rep semantics);
                 // axis 2 below is the per-memory firewall.
                 trustedOrigin: true,
-                // FOLD-04 AXIS 2 (the old layer-1 firewall, memory-user-representation-job.ts:322):
+                // Trust axis 2 (the old layer-1 firewall, memory-user-representation-job.ts:322):
                 // an `external`-trust source memory NEVER seeds a doc — the job SELECT excludes it.
                 sourceTrustExternal: rowTrust === "external",
             });

package/node_modules/@comis/daemon/dist/wiring/setup-channels-adapters.d.ts

@@ -1,14 +1,14 @@
 /**
  * Per-platform channel adapter bootstrap: credential validation and plugin
- * creation for 8 platforms (Telegram, Discord, Slack, WhatsApp, Signal, LINE,
- * iMessage, IRC).
+ * creation for 10 platforms (Telegram, Discord, Slack, WhatsApp, Signal, LINE,
+ * iMessage, IRC, Email, Microsoft Teams).
  * Extracted from setup-channels.ts to isolate the per-platform bootstrap block
- * (~170 lines) into a single-concern module.
+ * into a single-concern module.
  * @module
  */
-import type { AppContainer, ChannelPort, ChannelPluginPort } from "@comis/core";
+import type { AppContainer, ChannelPort, ChannelPluginPort, EnvPort, MsTeamsConversationStorePort, TimerPort } from "@comis/core";
 import type { ComisLogger } from "@comis/infra";
-import { type TelegramPluginHandle, type LinePluginHandle } from "@comis/channels";
+import { type TelegramPluginHandle, type LinePluginHandle, type MsTeamsPluginHandle } from "@comis/channels";
 /** Output of the adapter bootstrap phase. */
 export interface AdapterBootstrapResult {
     /** Channel adapters keyed by platform type (telegram, discord, etc.). */
@@ -20,6 +20,16 @@ export interface AdapterBootstrapResult {
     /** Full plugin objects keyed by channel type for capabilities RPC and
      *  per-channel capability lookups (features.reactions, replyToMetaKey). */
     channelPlugins: Map<string, ChannelPluginPort>;
+    /** Microsoft Teams inbound ingress sub-app — built here when the channel is
+     *  enabled with valid credentials, from the real adapter's inbound driver +
+     *  the bound activity-token validator. The composition root threads it to the
+     *  gateway so the `/channels/msteams` route mounts only when a caller-backed
+     *  ingress exists. Undefined when the channel is disabled. */
+    msTeamsIngress?: import("hono").Hono;
+    /** Microsoft Teams plugin handle (needed by the media pipeline for resolver
+     *  creation — mirrors tgPlugin/linePlugin). Undefined when the channel is
+     *  disabled or its credentials are invalid. */
+    msTeamsPlugin?: MsTeamsPluginHandle;
 }
 /**
  * Bootstrap all enabled channel adapters from config. Each platform block
@@ -31,4 +41,17 @@ export interface AdapterBootstrapResult {
 export declare function bootstrapAdapters(deps: {
     container: AppContainer;
     channelsLogger: ComisLogger;
+    /** Persisted conversation-reference store (built once on the shared memory.db),
+     *  injected into the Teams plugin so every inbound captures the routing tuple
+     *  and a proactive send recovers it. Optional: absent → the adapter skips
+     *  capture and a proactive send errs (never a wrong-host default). */
+    msTeamsConversationStore?: MsTeamsConversationStorePort;
+    /** Daemon TimerPort, injected into the Teams plugin for its typing keepalive.
+     *  Optional: absent → the keepalive degrades to a no-op (never a raw setTimeout). */
+    timer?: TimerPort;
+    /** Live composition-root EnvPort, threaded into the Teams plugin for the
+     *  managed-identity App-Service endpoint + rotating header (read live per mint).
+     *  Optional: absent → managed-identity mint falls to IMDS (VM/AKS), which needs
+     *  no env. */
+    env?: EnvPort;
 }): Promise<AdapterBootstrapResult>;

package/node_modules/@comis/daemon/dist/wiring/setup-channels-adapters.js

@@ -1,15 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
  * Per-platform channel adapter bootstrap: credential validation and plugin
- * creation for 8 platforms (Telegram, Discord, Slack, WhatsApp, Signal, LINE,
- * iMessage, IRC).
+ * creation for 10 platforms (Telegram, Discord, Slack, WhatsApp, Signal, LINE,
+ * iMessage, IRC, Email, Microsoft Teams).
  * Extracted from setup-channels.ts to isolate the per-platform bootstrap block
- * (~170 lines) into a single-concern module.
+ * into a single-concern module.
  * @module
  */
-import { createTelegramPlugin, createDiscordPlugin, createSlackPlugin, createWhatsAppPlugin, createSignalPlugin, createLinePlugin, createIMessagePlugin, createIrcPlugin, createEmailPlugin, validateBotToken, validateDiscordToken, validateSlackCredentials, validateWhatsAppAuth, validateSignalConnection, validateLineCredentials, validateIMessageConnection, validateIrcConnection, validateEmailCredentials, } from "@comis/channels";
+import { createTelegramPlugin, createDiscordPlugin, createSlackPlugin, createWhatsAppPlugin, createSignalPlugin, createLinePlugin, createIMessagePlugin, createIrcPlugin, createEmailPlugin, createMsTeamsPlugin, validateBotToken, validateDiscordToken, validateSlackCredentials, validateWhatsAppAuth, validateSignalConnection, validateLineCredentials, validateIMessageConnection, validateIrcConnection, validateEmailCredentials, validateMsTeamsCredentials, } from "@comis/channels";
+import { createMsTeamsIngress } from "@comis/gateway";
+import { resolveTestActivityValidator, resolveTestConnectorFetch, } from "./msteams-test-seams.js";
 import os from "node:os";
-import { safePath } from "@comis/core";
+import { safePath, systemNowMs } from "@comis/core";
 // ---------------------------------------------------------------------------
 // Bootstrap function
 // ---------------------------------------------------------------------------
@@ -21,12 +23,14 @@ import { safePath } from "@comis/core";
  * @returns Adapter map plus plugin handles needed by the media pipeline
  */
 export async function bootstrapAdapters(deps) {
-    const { container, channelsLogger } = deps;
+    const { container, channelsLogger, msTeamsConversationStore, timer, env } = deps;
     const channelConfig = container.config.channels;
     const adaptersByType = new Map();
     const channelPlugins = new Map();
     let tgPlugin;
     let linePlugin;
+    let msTeamsIngress;
+    let msTeamsPlugin;
     // Helper: attempt to get a secret, return undefined if not found
     const getSecret = (name) => {
         try {
@@ -322,6 +326,101 @@ export async function bootstrapAdapters(deps) {
                 channelsLogger.warn({ hint: "Set address, imapHost, and smtpHost in channels.email config", errorKind: "config" }, "Email enabled but missing required fields (address, imapHost, smtpHost)");
             }
         }
+        // Microsoft Teams — a route-driven channel whose inbound arrives over the
+        // net-new gateway ingress. This block is the production CALLER that builds
+        // that ingress: on valid credentials it registers the adapter/plugin, then
+        // wires the REAL adapter's handleWebhookEvents + the bound activity-token
+        // validator into createMsTeamsIngress and exposes the sub-app for the gateway
+        // phase to mount at /channels/msteams. A mounted route MUST reach the real
+        // adapter — there is no factory without a caller.
+        if (channelConfig.msteams.enabled) {
+            const authMode = channelConfig.msteams.authMode ?? "secret";
+            const appPassword = channelConfig.msteams.appPassword || getSecret("MSTEAMS_APP_PASSWORD");
+            const appId = channelConfig.msteams.appId;
+            const tenantId = channelConfig.msteams.tenantId;
+            const certPath = channelConfig.msteams.certPath;
+            const managedIdentityClientId = channelConfig.msteams.managedIdentityClientId;
+            const validation = validateMsTeamsCredentials({ authMode, appId, appPassword, tenantId, certPath, managedIdentityClientId });
+            // Per-mode credential precondition: secret needs the resolved appPassword,
+            // certificate needs certPath, managed-identity needs managedIdentityClientId
+            // (all still need appId + tenantId + a passing validation). A cert/MI config
+            // carries no appPassword, so the old appPassword-only gate silently dropped it.
+            const perModeCredentialPresent = authMode === "certificate"
+                ? Boolean(certPath)
+                : authMode === "managedIdentity"
+                    ? Boolean(managedIdentityClientId)
+                    : Boolean(appPassword);
+            if (validation.ok && appId && tenantId && perModeCredentialPresent) {
+                // OFF-BY-DEFAULT live-test seams (see msteams-test-seams.ts): with the
+                // COMIS_MSTEAMS_TEST_* env vars unset — the production case — getEnv returns
+                // undefined, so testConnectorFetch is undefined (adapter keeps the global
+                // fetch) and the ingress validator is the live remote-JWKS one. Neither seam
+                // relaxes a security control; they only let a loopback emulator round-trip.
+                // Reads via the injected EnvPort (the sanctioned env boundary — never direct
+                // process.env); the live daemon EnvPort wraps process.env, so the operator's
+                // COMIS_MSTEAMS_TEST_* vars are seen. Absent env → the seams stay off.
+                const getEnv = (name) => env?.get(name);
+                const testConnectorFetch = resolveTestConnectorFetch(getEnv);
+                const plugin = createMsTeamsPlugin({
+                    authMode,
+                    appId,
+                    // Secret mode sends the resolved password; cert/MI carry none (empty placeholder).
+                    appPassword: appPassword ?? "",
+                    tenantId,
+                    ...(certPath ? { certPath } : {}),
+                    ...(managedIdentityClientId ? { managedIdentityClientId } : {}),
+                    cloud: channelConfig.msteams.cloud,
+                    allowFrom: channelConfig.msteams.allowFrom,
+                    allowMode: channelConfig.msteams.allowMode,
+                    logger: channelsLogger,
+                    // Inject the shared conversation-reference store + the daemon TimerPort
+                    // as the @comis/core port types (never a raw db into @comis/channels):
+                    // capture on every inbound + proactive-send recovery + the typing keepalive.
+                    // The live EnvPort feeds the managed-identity App-Service endpoint/header
+                    // (read live per mint); absent → managed-identity falls to IMDS.
+                    ...(msTeamsConversationStore ? { conversationStore: msTeamsConversationStore } : {}),
+                    ...(timer ? { timer } : {}),
+                    ...(env ? { env } : {}),
+                    // Test-only outbound redirect (undefined in production → global fetch).
+                    ...(testConnectorFetch ? { fetchImpl: testConnectorFetch } : {}),
+                });
+                adaptersByType.set("msteams", plugin.adapter);
+                channelPlugins.set("msteams", plugin);
+                // Capture the handle so the media pipeline can build the msteams-file
+                // resolver over its Connector-token getter (mirrors tgPlugin/linePlugin).
+                msTeamsPlugin = plugin;
+                const teamsAdapter = plugin.adapter;
+                msTeamsIngress = createMsTeamsIngress({
+                    // Default: the live remote-JWKS validator bound to appId. With the
+                    // off-by-default COMIS_MSTEAMS_TEST_JWKS seam set, a local-JWKS validator
+                    // instead — a full verify against the emulator's key, not a bypass.
+                    validateActivityJwt: resolveTestActivityValidator(appId, getEnv, {
+                        logger: channelsLogger,
+                    }),
+                    handleWebhookEvents: (activities) => teamsAdapter.handleWebhookEvents(activities),
+                    // Bridge the ingress auth-gate rejections onto the daemon eventBus as a
+                    // content-free health_signal, so a forged/expired/wrong-audience/missing-
+                    // token flood is COUNTED by `comis fleet` instead of raw-log-only. Carries
+                    // the channel label + closed reason class only — never the token/header/body.
+                    onAuthRejected: (reason) => container.eventBus.emit("channel:ingress_auth_rejected", {
+                        channelType: "msteams",
+                        reason,
+                        timestamp: systemNowMs(),
+                    }),
+                    logger: channelsLogger,
+                });
+                channelsLogger.info({ channelType: "msteams", authMode, tenantId }, "Channel adapter initialized");
+            }
+            else {
+                // Mode-specific hint: name the exact credential the configured authMode needs.
+                const credHint = authMode === "certificate"
+                    ? "Set msteams.certPath (certificate mode) and msteams.appId/tenantId"
+                    : authMode === "managedIdentity"
+                        ? "Set msteams.managedIdentityClientId (managed-identity mode) and msteams.appId/tenantId"
+                        : "Verify msteams.appId/tenantId and MSTEAMS_APP_PASSWORD";
+                channelsLogger.warn({ hint: credHint, errorKind: "auth" }, "Teams credential validation failed");
+            }
+        }
         if (adaptersByType.size > 0) {
             channelsLogger.info({ channels: Array.from(adaptersByType.keys()), count: adaptersByType.size }, "Channel adapters initialized");
         }
@@ -329,5 +428,5 @@ export async function bootstrapAdapters(deps) {
             channelsLogger.debug("No channel adapters enabled");
         }
     } // end if (channelConfig)
-    return { adaptersByType, tgPlugin, linePlugin, channelPlugins };
+    return { adaptersByType, tgPlugin, linePlugin, channelPlugins, msTeamsIngress, msTeamsPlugin };
 }

package/node_modules/@comis/daemon/dist/wiring/setup-channels-media.d.ts

@@ -9,7 +9,7 @@
 import type { AppContainer, Attachment, ChannelPort, NormalizedMessage, TranscriptionPort, ImageAnalysisPort, FileExtractionPort, FileExtractionConfig, MemoryPort, WrapExternalContentOptions } from "@comis/core";
 import type { MediaResolverPort } from "@comis/core";
 import type { ComisLogger } from "@comis/infra";
-import { type TelegramPluginHandle, type LinePluginHandle } from "@comis/channels";
+import { type TelegramPluginHandle, type LinePluginHandle, type MsTeamsPluginHandle } from "@comis/channels";
 import { type SsrfGuardedFetcher } from "@comis/skills";
 import type { LinkRunner } from "@comis/skills";
 /** Output of the media pipeline assembly. */
@@ -30,6 +30,7 @@ export interface MediaPipelineDeps {
     adaptersByType: Map<string, ChannelPort>;
     tgPlugin?: TelegramPluginHandle;
     linePlugin?: LinePluginHandle;
+    msTeamsPlugin?: MsTeamsPluginHandle;
     ssrfFetcher: SsrfGuardedFetcher;
     linkRunner: LinkRunner;
     transcriber?: TranscriptionPort;

package/node_modules/@comis/daemon/dist/wiring/setup-channels-media.js

@@ -11,7 +11,7 @@ import { randomUUID } from "node:crypto";
 import { isVisionCapable } from "@comis/agent";
 import { createWhatsAppResolver, createSlackResolver, createIMessageResolver, audioPreflight, } from "@comis/channels";
 import { createCompositeResolver, createMediaPersistenceService, preprocessMessage, sanitizeImageForApi, createVisionProviderRegistry, selectVisionProvider, } from "@comis/skills";
-import { getModel } from "@earendil-works/pi-ai";
+import { getModel } from "@earendil-works/pi-ai/compat";
 import { safePath, systemNowMs } from "@comis/core";
 import os from "node:os";
 // ---------------------------------------------------------------------------
@@ -24,7 +24,7 @@ import os from "node:os";
  * @returns Composite resolver, attachment resolver, message preprocessor, audio preflight
  */
 export async function buildMediaPipeline(deps) {
-    const { container, channelsLogger, adaptersByType, tgPlugin, linePlugin, ssrfFetcher, linkRunner, transcriber, maxMediaBytes, defaultAgentId, onSuspiciousContent, } = deps;
+    const { container, channelsLogger, adaptersByType, tgPlugin, linePlugin, msTeamsPlugin, ssrfFetcher, linkRunner, transcriber, maxMediaBytes, defaultAgentId, onSuspiciousContent, } = deps;
     // -- Media file persistence --
     const persistenceConfig = container.config.integrations.media.persistence;
     const persistenceEnabled = persistenceConfig.enabled && !!deps.workspaceDirs;
@@ -125,6 +125,18 @@ export async function buildMediaPipeline(deps) {
     if (linePlugin) {
         platformResolvers.push(linePlugin.createResolver({ maxBytes: maxMediaBytes, logger: channelsLogger }));
     }
+    // Microsoft Teams: resolver created from plugin handle (closes over the
+    // Connector-token getter). The SAME injected auth-capable ssrfFetcher + the
+    // config allowlist (the resolver applies its built-in default when empty) —
+    // never a bare fetch or an over-broad list.
+    if (msTeamsPlugin) {
+        platformResolvers.push(msTeamsPlugin.createResolver({
+            ssrfFetcher,
+            maxBytes: maxMediaBytes,
+            logger: channelsLogger,
+            mediaAuthAllowHosts: channelConfig?.msteams?.mediaAuthAllowHosts ?? [],
+        }));
+    }
     // Create CompositeResolver with all per-platform resolvers + SSRF fallback
     const compositeResolver = createCompositeResolver({
         resolvers: platformResolvers,

package/node_modules/@comis/daemon/dist/wiring/setup-context-tools.d.ts

@@ -1,11 +1,11 @@
 /**
- * Daemon-side wiring for the in-session expansion-loop `ctx_*` tools
- * (v2.12 Phase 131, E1/E2): `ctx_search` / `ctx_inspect` / `ctx_expand`.
+ * Daemon-side wiring for the in-session expansion-loop `ctx_*` tools:
+ * `ctx_search` / `ctx_inspect` / `ctx_expand`.
  *
  * The daemon is the composition root — it constructs the concrete LCD store
  * (`createLcdStore`, in `setup-memory`) and injects it here AS the core
  * `ContextStorePort` TYPE, then pushes the three tools onto the agent tool array
- * sharing ONE `ContextToolDeps`. This mirrors the v2.11 terminal-driver wiring
+ * sharing ONE `ContextToolDeps`. This mirrors the terminal-driver wiring
  * (`wireTerminalTools`) exactly: a direct-injection, never-export, owner-scoped
  * tool set wired OUTSIDE the platform-tool parity registry — it is structurally
  * DISTINCT from the cross-session recall layer (no in-process RPC dispatch, no
@@ -42,16 +42,16 @@ export interface ContextWiringDeps {
     /** Inline-output cap before `ctx_expand` spills to a file (from `ContextEngineConfig`, default 4000). */
     readonly maxExpandTokens: number;
     /**
-     * DEPTH-02: tier-gated max BFS hop depth for the `ctx_expand` multi-hop walk
+     * Tier-gated max BFS hop depth for the `ctx_expand` multi-hop walk
      * (nano1/small2/mid3/frontier4). The daemon resolves it from the agent's
      * `ModelProfile` at `setup-tools.ts` (a capacity knob — wiring-time is correct;
-     * R4 scope stays per-call). Absent ⇒ a conservative single-hop depth of 1.
+     * the read scope stays per-call). Absent ⇒ a conservative single-hop depth of 1.
      */
     readonly maxExpandDepth?: number;
     /** Per-call session tool-results dir resolver (the hoisted exec-tool precedent). */
     readonly getToolResultsDir: () => string | undefined;
     /**
-     * Optional structural event bus (O1) — the daemon's real `TypedEventBus`,
+     * Optional structural event bus — the daemon's real `TypedEventBus`,
      * passed structurally so the skills layer never value-imports it. Threaded
      * onto the shared `ContextToolDeps` so each ctx_* hit emits a content-free
      * `context:dag_expanded`. Absent ⇒ a silent no-op.
@@ -61,7 +61,7 @@ export interface ContextWiringDeps {
     };
 }
 /**
- * Wire the three never-export, dag-mode in-session expansion tools (E1/E2).
+ * Wire the three never-export, dag-mode in-session expansion tools.
  * Mirrors `wireTerminalTools`: build one shared `ContextToolDeps` from the
  * injected store + the daemon deps, then push the three factories onto the
  * agent tool array. The `store` is the concrete `createLcdStore` adapter the
@@ -81,13 +81,13 @@ export interface CtxToolAgentConfig {
 }
 /**
  * Gate + wire the dag-mode `ctx_*` tools (extracted from `setup-tools.ts` to keep that file
- * under the 800-line cap — Phase 174-04). Wires the tools when the agent's
+ * under the 800-line cap). Wires the tools when the agent's
  * `contextEngine.version` resolves to `"dag"` AND a store is present.
  *
- * WR-05 (Phase 174-04): the missing-version default is `"dag"` — ALIGNED with
- * `shouldRunLcdStorePasses` (which gates the LCD store WRITES + the DEPTH-03 sweep), so a bare
+ * The missing-version default is `"dag"` — ALIGNED with
+ * `shouldRunLcdStorePasses` (which gates the LCD store WRITES + its sweep), so a bare
  * agent config that writes durable history also wires the `ctx_*` tools that read it back (was
- * `?? "pipeline"` — a pre-existing skew). WR-04: the operator `capabilityClassOverride` (the
+ * `?? "pipeline"` — a pre-existing skew). The operator `capabilityClassOverride` (the
  * same `providers.entries.<id>.capabilities.capabilityClass` source pi-executor uses, supplied
  * by the caller) governs the tier-gated `ctx_expand` walk depth; absent ⇒ provider-family
  * heuristic. No-op (nothing pushed) when not dag mode or no store.
@@ -96,13 +96,13 @@ export declare function maybeWireContextTools(tools: AgentToolArray, store: Cont
     capabilityClassOverride?: CapabilityClass;
 }): void;
 /**
- * DEPTH-02: resolve the tier-gated `ctx_expand` multi-hop walk depth
+ * Resolve the tier-gated `ctx_expand` multi-hop walk depth
  * (nano1/small2/mid3/frontier4) from an agent's `model`/`provider`.
  *
- * `RequestContext` carries NO `capabilityClass` (Pitfall 3), so the cap is
+ * `RequestContext` carries NO `capabilityClass`, so the cap is
  * resolved HERE at wiring time from the agent's `ModelProfile`. The DEPTH cap is
  * a CAPACITY knob, NOT a scope — wiring-time resolution is correct even when one
- * `wireContextTools` call serves multiple agents per channel (A3); the R4 read
+ * `wireContextTools` call serves multiple agents per channel; the read
  * scope still comes per-call from `requireCtxScope()` inside each tool. The
  * capability axis ignores `contextWindow`, so the minimal `{ id, provider }` the
  * memory-ops resolver uses is correct here too (resolve-memory-ops-capability.ts).
@@ -110,7 +110,7 @@ export declare function maybeWireContextTools(tools: AgentToolArray, store: Cont
  * `model`/`provider` default to "default" on a parsed agent config; an undefined
  * or unknown model fails closed to the most-locked profile (nano → depth 1).
  *
- * WR-04 (Phase 174-04): `capabilityClassOverride` is the operator's per-provider
+ * `capabilityClassOverride` is the operator's per-provider
  * `providers.entries.<id>.capabilities.capabilityClass` pin (the same source pi-executor
  * threads into the live ModelProfile). When supplied it wins over the provider-family
  * heuristic, so an operator who pins a large quantized ollama model "mid" gets the mid