msteams-mcp 0.29.1 → 0.29.2

package/README.md

@@ -4,7 +4,7 @@
 [![npm version](https://img.shields.io/npm/v/msteams-mcp.svg)](https://www.npmjs.com/package/msteams-mcp)
 [![npm downloads](https://img.shields.io/npm/dm/msteams-mcp.svg)](https://www.npmjs.com/package/msteams-mcp)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Node.js](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg)](https://nodejs.org/)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
 
 Give AI access to Microsoft Teams easily with your standard Teams login. 
 
@@ -27,7 +27,7 @@ Search messages and email, catch up on unread chats, read threads, send replies,
 
 ### Prerequisites
 
-- Node.js 18+
+- Node.js 20+
 - A Microsoft account with Teams access
 - Google Chrome, Microsoft Edge, or Chromium browser installed
 

package/dist/auth/session-store.js

@@ -13,7 +13,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import { encrypt, decrypt } from './crypto.js';
-import { SESSION_EXPIRY_HOURS } from '../constants.js';
+import { SESSION_EXPIRY_HOURS, TEAMS_HOSTS } from '../constants.js';
 import * as log from '../utils/logger.js';
 /**
  * User-specific config directory for teams-mcp-server.
@@ -131,12 +131,7 @@ export function clearTokenCache() {
  * Known Teams origins (commercial and government clouds).
  * Used to find the correct origin in session state.
  */
-const TEAMS_ORIGINS = [
-    'https://teams.cloud.microsoft', // New Teams URL (often holds SubstrateSearch tokens)
-    'https://teams.microsoft.com', // Commercial legacy
-    'https://teams.microsoft.us', // GCC-High
-    'https://dod.teams.microsoft.us', // DoD
-];
+const TEAMS_ORIGINS = TEAMS_HOSTS.map(host => `https://${host}`);
 /**
  * Returns true if localStorage has a SubstrateSearch MSAL token entry.
  */
@@ -177,6 +172,6 @@ export function getTeamsOrigin(state) {
         if (origin)
             return origin;
     }
-    // Fallback: find any origin containing 'teams.microsoft'
-    return state.origins.find(o => o.origin.includes('teams.microsoft') || o.origin.includes('teams.cloud')) ?? null;
+    // Fallback: any origin on a known Teams host
+    return state.origins.find(o => TEAMS_HOSTS.some(host => o.origin.includes(host))) ?? null;
 }

package/dist/browser/auth.d.ts

@@ -3,6 +3,19 @@
  * Manages login detection and manual authentication flows.
  */
 import type { Page, BrowserContext } from 'playwright';
+interface AuthStatus {
+    isAuthenticated: boolean;
+    isOnLoginPage: boolean;
+    currentUrl: string;
+}
+/**
+ * Gets the current authentication status.
+ */
+export declare function getAuthStatus(page: Page): Promise<AuthStatus>;
+/**
+ * Checks if a URL is a Teams domain.
+ */
+export declare function isTeamsUrl(url: string): boolean;
 /**
  * Performs a full authentication flow:
  * 1. Navigate to Teams
@@ -16,3 +29,4 @@ import type { Page, BrowserContext } from 'playwright';
  * @param headless - If true, throw immediately if user interaction is required (default: false)
  */
 export declare function ensureAuthenticated(page: Page, context: BrowserContext, onProgress?: (message: string) => void, showOverlay?: boolean, headless?: boolean): Promise<void>;
+export {};

package/dist/browser/auth.js

@@ -3,7 +3,7 @@
  * Manages login detection and manual authentication flows.
  */
 import { saveSessionState } from './context.js';
-import { OVERLAY_STEP_PAUSE_MS, OVERLAY_COMPLETE_PAUSE_MS, } from '../constants.js';
+import { OVERLAY_STEP_PAUSE_MS, OVERLAY_COMPLETE_PAUSE_MS, TEAMS_HOSTS, } from '../constants.js';
 import { extractSubstrateToken } from '../auth/token-extractor.js';
 import * as logger from '../utils/logger.js';
 /**
@@ -145,41 +145,16 @@ const LOGIN_URL_PATTERNS = [
     'login.live.com',
     'login.microsoft.com',
 ];
-// Selectors that indicate successful authentication
-const AUTH_SUCCESS_SELECTORS = [
-    '[data-tid="app-bar"]',
-    '[data-tid="search-box"]',
-    'input[placeholder*="Search"]',
-    '[data-tid="chat-list"]',
-    '[data-tid="team-list"]',
-];
 /**
  * Checks if the current page URL indicates a login flow.
  */
 function isLoginUrl(url) {
     return LOGIN_URL_PATTERNS.some(pattern => url.includes(pattern));
 }
-/**
- * Checks if the page shows authenticated Teams content.
- */
-async function hasAuthenticatedContent(page) {
-    for (const selector of AUTH_SUCCESS_SELECTORS) {
-        try {
-            const count = await page.locator(selector).count();
-            if (count > 0) {
-                return true;
-            }
-        }
-        catch {
-            // Selector not found, continue checking others
-        }
-    }
-    return false;
-}
 /**
  * Gets the current authentication status.
  */
-async function getAuthStatus(page) {
+export async function getAuthStatus(page) {
     const currentUrl = page.url();
     const onLoginPage = isLoginUrl(currentUrl);
     // If on login page, definitely not authenticated
@@ -190,11 +165,15 @@ async function getAuthStatus(page) {
             currentUrl,
         };
     }
-    // If on Teams domain, check for authenticated content
-    if (currentUrl.includes('teams.microsoft.com')) {
-        const hasContent = await hasAuthenticatedContent(page);
+    // On a Teams domain, a live MSAL token is the proof of sign-in: it is what
+    // every API call needs and what the saved session is for. Teams' own DOM
+    // markers are not a usable signal — new Teams renders none of the `data-tid`
+    // elements earlier versions exposed, so waiting for them left a completed
+    // login undetected and the browser window open until the manual-login
+    // timeout.
+    if (isTeamsUrl(currentUrl)) {
         return {
-            isAuthenticated: hasContent,
+            isAuthenticated: await checkBrowserTokenExpiry(page) > 0,
             isOnLoginPage: false,
             currentUrl,
         };
@@ -208,18 +187,11 @@ async function getAuthStatus(page) {
 }
 /** Timeout for detecting login redirect (ms). */
 const LOGIN_REDIRECT_TIMEOUT_MS = 5000;
-/** URL patterns that indicate we're on a Teams page (not redirected elsewhere). */
-const TEAMS_URL_PATTERNS = [
-    'teams.microsoft.com',
-    'teams.microsoft.us', // GCC-High
-    'dod.teams.microsoft.us', // DoD
-    'teams.cloud.microsoft', // New Teams URL
-];
 /**
  * Checks if a URL is a Teams domain.
  */
-function isTeamsUrl(url) {
-    return TEAMS_URL_PATTERNS.some(pattern => url.includes(pattern));
+export function isTeamsUrl(url) {
+    return TEAMS_HOSTS.some(host => url.includes(host));
 }
 /**
  * Navigates to Teams and checks authentication status.

package/dist/browser/auth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/browser/auth.test.js

@@ -0,0 +1,45 @@
+import { describe, expect, it, vi } from 'vitest';
+vi.mock('./context.js', () => ({ saveSessionState: vi.fn() }));
+vi.mock('../auth/token-extractor.js', () => ({ extractSubstrateToken: vi.fn() }));
+import { getAuthStatus, isTeamsUrl } from './auth.js';
+/** A page on `url` with no Teams DOM markers and `tokenMinutes` left on MSAL. */
+function fakePage(url, tokenMinutes) {
+    return {
+        url: () => url,
+        locator: () => ({ count: async () => 0 }),
+        evaluate: async () => tokenMinutes,
+    };
+}
+describe('isTeamsUrl', () => {
+    it('covers every host Microsoft redirects Teams users to', () => {
+        // New Teams settles on the bare host, with no path.
+        for (const url of [
+            'https://teams.microsoft.com/',
+            'https://teams.cloud.microsoft/',
+            'https://teams.chat.microsoft.com/',
+            'https://teams.microsoft.us/',
+            'https://dod.teams.microsoft.us/',
+        ]) {
+            expect(isTeamsUrl(url), url).toBe(true);
+        }
+        expect(isTeamsUrl('https://outlook.office.com/')).toBe(false);
+    });
+    it('matches on the host, whatever path the app has routed to', () => {
+        expect(isTeamsUrl('https://teams.microsoft.com/v2/#/conversations/19:abc@thread.tacv2')).toBe(true);
+    });
+});
+describe('getAuthStatus', () => {
+    it('detects a completed login from the MSAL token alone', async () => {
+        const status = await getAuthStatus(fakePage('https://teams.cloud.microsoft/', 55));
+        expect(status.isAuthenticated).toBe(true);
+        expect(status.isOnLoginPage).toBe(false);
+    });
+    it('stays unauthenticated on a Teams host with no token', async () => {
+        const status = await getAuthStatus(fakePage('https://teams.cloud.microsoft/', -1));
+        expect(status.isAuthenticated).toBe(false);
+    });
+    it('reports the login page', async () => {
+        const status = await getAuthStatus(fakePage('https://login.microsoftonline.com/common/oauth2', 99));
+        expect(status).toMatchObject({ isAuthenticated: false, isOnLoginPage: true });
+    });
+});

package/dist/constants.d.ts

@@ -101,3 +101,12 @@ export declare const STANDARD_EMOJIS: readonly StandardEmoji[];
 export declare const ASSIGNMENTS_APP_ID = "8f348934-64be-4bb2-bc16-c54c96789f43";
 /** Microsoft Graph token audiences: MSAL caches either the URL or the app ID. */
 export declare const GRAPH_AUDIENCES: readonly string[];
+/**
+ * Teams web hosts, in the order a session's origins should be preferred.
+ *
+ * Microsoft keeps adding hosts (`teams.cloud.microsoft`, then
+ * `teams.chat.microsoft.com`) and redirects users to them without warning, so
+ * every host check reads this one list: a missing host makes login detection
+ * fail on a page that is in fact signed in.
+ */
+export declare const TEAMS_HOSTS: readonly string[];

package/dist/constants.js

@@ -192,3 +192,18 @@ export const STANDARD_EMOJIS = [
 export const ASSIGNMENTS_APP_ID = '8f348934-64be-4bb2-bc16-c54c96789f43';
 /** Microsoft Graph token audiences: MSAL caches either the URL or the app ID. */
 export const GRAPH_AUDIENCES = ['https://graph.microsoft.com', '00000003-0000-0000-c000-000000000000'];
+/**
+ * Teams web hosts, in the order a session's origins should be preferred.
+ *
+ * Microsoft keeps adding hosts (`teams.cloud.microsoft`, then
+ * `teams.chat.microsoft.com`) and redirects users to them without warning, so
+ * every host check reads this one list: a missing host makes login detection
+ * fail on a page that is in fact signed in.
+ */
+export const TEAMS_HOSTS = [
+    'teams.cloud.microsoft', // New Teams (often holds the SubstrateSearch token)
+    'teams.chat.microsoft.com', // New Teams chat host
+    'teams.microsoft.com', // Commercial legacy
+    'teams.microsoft.us', // GCC-High
+    'dod.teams.microsoft.us', // DoD
+];

package/dist/tools/auth-tools.js

@@ -6,7 +6,8 @@ import { z } from 'zod';
 const require = createRequire(import.meta.url);
 const pkg = require('../../package.json');
 import { hasSessionState, isSessionLikelyExpired, clearSessionState, clearTokenCache, } from '../auth/session-store.js';
-import { getSubstrateTokenStatus, getMessageAuthStatus, extractMessageAuth, extractCsaToken, } from '../auth/token-extractor.js';
+import { getSubstrateTokenStatus, getMessageAuthStatus, extractMessageAuth, extractCsaToken, extractSubstrateToken, extractSkypeSpacesToken, } from '../auth/token-extractor.js';
+import { refreshTokensViaHttp } from '../auth/token-refresh-http.js';
 import { createBrowserContext, closeBrowser } from '../browser/context.js';
 import * as log from '../utils/logger.js';
 import { resetAssignmentsAvailability } from '../utils/auth-guards.js';
@@ -46,6 +47,31 @@ const statusToolDefinition = {
 // ─────────────────────────────────────────────────────────────────────────────
 /** Minimum minutes remaining on token to consider it valid (skip browser). */
 const TOKEN_VALID_THRESHOLD_MINUTES = 10;
+/** Every core credential a session needs: search, calendar, favourites, messaging. */
+function coreCredentialsComplete() {
+    return extractSubstrateToken() !== null
+        && extractSkypeSpacesToken() !== null
+        && extractCsaToken() !== null
+        && extractMessageAuth() !== null;
+}
+/**
+ * Mints any core credential the browser did not leave in the saved session.
+ *
+ * Teams JS acquires some resource tokens lazily — the CSA (chatsvcagg) token
+ * behind favourites is routinely absent from a session saved straight after
+ * SSO, so login would report success while teams_status reported favourites
+ * unavailable until some later call happened to trigger a refresh. One HTTP
+ * exchange mints every core resource. Failure is non-fatal: the session is
+ * still usable and the next tool call retries through auto-login.
+ */
+async function fillCoreCredentialGaps() {
+    if (coreCredentialsComplete())
+        return;
+    const result = await refreshTokensViaHttp();
+    if (!result.ok) {
+        log.warn('login', `Could not top up core credentials: ${result.error.message}`);
+    }
+}
 async function handleLogin(input) {
     // A fresh login may have changed what the account can access (e.g. new consent)
     resetAssignmentsAvailability();
@@ -57,6 +83,7 @@ async function handleLogin(input) {
         // Fast path: if tokens are still valid, skip browser entirely
         const tokenStatus = getSubstrateTokenStatus();
         if (tokenStatus.hasToken && tokenStatus.minutesRemaining >= TOKEN_VALID_THRESHOLD_MINUTES) {
+            await fillCoreCredentialGaps();
             return {
                 success: true,
                 data: {
@@ -83,6 +110,7 @@ async function handleLogin(input) {
         true // Headless mode - throw immediately if user interaction required
         );
         await closeBrowser(headless, true);
+        await fillCoreCredentialGaps();
         return {
             success: true,
             data: {
@@ -103,6 +131,7 @@ async function handleLogin(input) {
         // Close browser after login - we only need the saved session/tokens
         await closeBrowser(visible, true);
     }
+    await fillCoreCredentialGaps();
     return {
         success: true,
         data: {

package/dist/tools/auth-tools.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tools/auth-tools.test.js

@@ -0,0 +1,67 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+vi.mock('../auth/session-store.js', () => ({
+    hasSessionState: vi.fn(() => true),
+    isSessionLikelyExpired: vi.fn(() => false),
+    clearSessionState: vi.fn(),
+    clearTokenCache: vi.fn(),
+}));
+vi.mock('../auth/token-extractor.js', () => ({
+    getSubstrateTokenStatus: vi.fn(),
+    getMessageAuthStatus: vi.fn(),
+    extractMessageAuth: vi.fn(),
+    extractCsaToken: vi.fn(),
+    extractSubstrateToken: vi.fn(),
+    extractSkypeSpacesToken: vi.fn(),
+}));
+vi.mock('../auth/token-refresh-http.js', () => ({ refreshTokensViaHttp: vi.fn() }));
+vi.mock('../browser/context.js', () => ({ createBrowserContext: vi.fn(), closeBrowser: vi.fn() }));
+vi.mock('../browser/auth.js', () => ({ ensureAuthenticated: vi.fn() }));
+vi.mock('../utils/auth-guards.js', () => ({ resetAssignmentsAvailability: vi.fn() }));
+import { loginTool } from './auth-tools.js';
+import { getSubstrateTokenStatus, extractMessageAuth, extractCsaToken, extractSubstrateToken, extractSkypeSpacesToken, } from '../auth/token-extractor.js';
+import { refreshTokensViaHttp } from '../auth/token-refresh-http.js';
+import { createBrowserContext, closeBrowser } from '../browser/context.js';
+/** A session holding every core credential except the CSA (favourites) token. */
+function sessionMissingCsaToken() {
+    vi.mocked(getSubstrateTokenStatus).mockReturnValue({ hasToken: true, minutesRemaining: 60 });
+    vi.mocked(extractSubstrateToken).mockReturnValue({ token: 'substrate', expiry: new Date(Date.now() + 3.6e6) });
+    vi.mocked(extractSkypeSpacesToken).mockReturnValue('spaces');
+    vi.mocked(extractMessageAuth).mockReturnValue({ skypeToken: 's', authToken: 'a', userMri: '8:orgid:u' });
+    vi.mocked(extractCsaToken).mockReturnValue(null);
+}
+describe('teams_login core credential top-up', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.mocked(refreshTokensViaHttp).mockResolvedValue({ ok: true, value: undefined });
+    });
+    it('mints the missing CSA token when the session is otherwise valid', async () => {
+        sessionMissingCsaToken();
+        const result = await loginTool.handler({ forceNew: false });
+        expect(result.success).toBe(true);
+        expect(refreshTokensViaHttp).toHaveBeenCalledOnce();
+        expect(createBrowserContext).not.toHaveBeenCalled();
+    });
+    it('skips the refresh when every core credential is present', async () => {
+        sessionMissingCsaToken();
+        vi.mocked(extractCsaToken).mockReturnValue('csa');
+        await loginTool.handler({ forceNew: false });
+        expect(refreshTokensViaHttp).not.toHaveBeenCalled();
+    });
+    it('tops up after a forced browser login leaves the CSA token behind', async () => {
+        sessionMissingCsaToken();
+        vi.mocked(createBrowserContext).mockResolvedValue({ page: {}, context: { clearCookies: vi.fn() } });
+        vi.mocked(closeBrowser).mockResolvedValue(undefined);
+        const result = await loginTool.handler({ forceNew: true });
+        expect(result.success).toBe(true);
+        expect(refreshTokensViaHttp).toHaveBeenCalledOnce();
+    });
+    it('still reports success when the top-up fails', async () => {
+        sessionMissingCsaToken();
+        vi.mocked(refreshTokensViaHttp).mockResolvedValue({
+            ok: false,
+            error: { code: 'NETWORK_ERROR', message: 'offline' },
+        });
+        const result = await loginTool.handler({ forceNew: false });
+        expect(result.success).toBe(true);
+    });
+});

package/dist/types/server.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Server interface types.
+ *
+ * Extracted to a shared module to avoid circular dependencies between
+ * server.ts and tools/index.ts.
+ */
+import type { BrowserManager } from '../browser/context.js';
+/**
+ * Interface for the TeamsServer class.
+ *
+ * This interface is used by tool handlers to interact with the server
+ * without creating circular dependencies.
+ */
+export interface TeamsServer {
+    /** Ensures a browser is running and authenticated. */
+    ensureBrowser(headless?: boolean): Promise<BrowserManager>;
+    /** Resets browser state (clears manager and initialisation flag). */
+    resetBrowserState(): void;
+    /** Gets the current browser manager, if any. */
+    getBrowserManager(): BrowserManager | null;
+    /** Sets the browser manager. */
+    setBrowserManager(manager: BrowserManager): void;
+    /** Marks the server as initialised. */
+    markInitialised(): void;
+    /** Checks if the server is initialised. */
+    isInitialisedState(): boolean;
+}

package/dist/types/server.js

@@ -0,0 +1,7 @@
+/**
+ * Server interface types.
+ *
+ * Extracted to a shared module to avoid circular dependencies between
+ * server.ts and tools/index.ts.
+ */
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "msteams-mcp",
-  "version": "0.29.1",
+  "version": "0.29.2",
   "description": "MCP server for Microsoft Teams - search messages, send replies, manage favourites",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "url": "https://github.com/m0nkmaster/msteams-mcp/issues"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "scripts": {
     "build": "tsc",
@@ -45,6 +45,7 @@
   "license": "MIT",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
+    "marked": "^18.0.14",
     "playwright": "^1.40.0",
     "zod": "~3.23.0"
   },