msteams-mcp 0.30.2 → 0.30.3

package/dist/auth/session-store.d.ts

@@ -63,11 +63,6 @@ export declare function writeSessionState(state: SessionState): void;
  * Deletes the session state file.
  */
 export declare function clearSessionState(): void;
-/**
- * Deletes everything stored locally: browser profile (cookies, MSAL caches,
- * every account ever signed in), session state and token cache.
- */
-export declare function clearAllLocalData(): void;
 /**
  * Gets the age of the session state in hours.
  */

package/dist/auth/session-store.js

@@ -86,13 +86,6 @@ export function clearSessionState() {
         fs.unlinkSync(SESSION_STATE_PATH);
     }
 }
-/**
- * Deletes everything stored locally: browser profile (cookies, MSAL caches,
- * every account ever signed in), session state and token cache.
- */
-export function clearAllLocalData() {
-    fs.rmSync(CONFIG_DIR, { recursive: true, force: true });
-}
 /**
  * Gets the age of the session state in hours.
  */

package/dist/browser/auth.js

@@ -386,7 +386,7 @@ export async function ensureAuthenticated(page, context, onProgress, showOverlay
     log('Navigating to Teams...');
     const status = await navigateToTeams(page);
     if (status.isAuthenticated) {
-        log('Teams loaded — saving session state.');
+        log('Already authenticated — saving session state.');
         await saveSessionState(context);
         // Check if the saved tokens are actually valid
         // Browser session cookies can outlive MSAL tokens (cookies last days, tokens ~1 hour)
@@ -407,11 +407,9 @@ export async function ensureAuthenticated(page, context, onProgress, showOverlay
             // Still no valid tokens after waiting
             throw new Error('Headless SSO failed: MSAL token refresh timed out');
         }
-        // No redirect to login does not mean signed in: Teams can render with the
-        // Microsoft SSO session gone and only a dead SPA refresh token in its cache.
-        // Keep the window open until a live token appears (silently or by sign-in).
-        log('Tokens expired. Sign in in the browser window if prompted.');
-        await waitForManualLogin(page, context, onProgress, showOverlay);
+        // In visible mode, the tokens might refresh while user interacts, or they can
+        // manually complete any prompts. We've saved what we have.
+        log('Session state saved (tokens may need refresh).');
         return;
     }
     // User interaction required - fail fast if headless

package/dist/browser/auth.test.js

@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from 'vitest';
 vi.mock('./context.js', () => ({ saveSessionState: vi.fn() }));
 vi.mock('../auth/token-extractor.js', () => ({ extractSubstrateToken: vi.fn() }));
-import { ensureAuthenticated, getAuthStatus, isTeamsUrl } from './auth.js';
+import { getAuthStatus, isTeamsUrl } from './auth.js';
 /** A page on `url` with no Teams DOM markers and `tokenMinutes` left on MSAL. */
 function fakePage(url, tokenMinutes) {
     return {
@@ -43,22 +43,3 @@ describe('getAuthStatus', () => {
         expect(status).toMatchObject({ isAuthenticated: false, isOnLoginPage: true });
     });
 });
-describe('ensureAuthenticated', () => {
-    it('keeps a visible browser open for sign-in when Teams loads with expired tokens', async () => {
-        // Teams can render without redirecting to login while the Microsoft SSO
-        // session is gone; only a fresh MSAL token proves the user has signed in.
-        const tokenMinutes = [-1, -1, 55];
-        const page = {
-            goto: async () => null,
-            waitForURL: async () => { throw new Error('timeout'); },
-            url: () => 'https://teams.cloud.microsoft/',
-            evaluate: async () => tokenMinutes.length > 1 ? tokenMinutes.shift() : tokenMinutes[0],
-            waitForTimeout: async () => { },
-        };
-        const messages = [];
-        await ensureAuthenticated(page, {}, msg => messages.push(msg), false, false);
-        expect(messages).toContain('Waiting for manual login...');
-        expect(messages).toContain('Authentication successful!');
-        expect(tokenMinutes).toEqual([55]);
-    });
-});

package/dist/browser/context.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Tests for browser channel selection.
+ *
+ * The server launches into its own profile dir, so the user's default browser
+ * is irrelevant - what matters is that every platform has an ordered list of
+ * channels to try and ends with a fallback that needs no system browser.
+ */
+export {};

package/dist/browser/context.test.js

@@ -0,0 +1,55 @@
+/**
+ * Tests for browser channel selection.
+ *
+ * The server launches into its own profile dir, so the user's default browser
+ * is irrelevant - what matters is that every platform has an ordered list of
+ * channels to try and ends with a fallback that needs no system browser.
+ */
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { browserChannels } from './context.js';
+/** Runs fn with process.platform stubbed, then restores the real value. */
+function withPlatform(platform, fn) {
+    const original = Object.getOwnPropertyDescriptor(process, 'platform');
+    Object.defineProperty(process, 'platform', { value: platform, configurable: true });
+    try {
+        return fn();
+    }
+    finally {
+        Object.defineProperty(process, 'platform', original);
+    }
+}
+describe('browserChannels', () => {
+    afterEach(() => {
+        vi.unstubAllEnvs();
+    });
+    it('prefers Edge on Windows, Chrome elsewhere', () => {
+        vi.stubEnv('TEAMS_BROWSER_CHANNEL', '');
+        expect(withPlatform('win32', browserChannels)[0]).toBe('msedge');
+        expect(withPlatform('darwin', browserChannels)[0]).toBe('chrome');
+        expect(withPlatform('linux', browserChannels)[0]).toBe('chrome');
+    });
+    it('offers both system channels on every platform', () => {
+        vi.stubEnv('TEAMS_BROWSER_CHANNEL', '');
+        for (const platform of ['win32', 'darwin', 'linux']) {
+            const channels = withPlatform(platform, browserChannels);
+            expect(channels).toContain('chrome');
+            expect(channels).toContain('msedge');
+        }
+    });
+    it('ends with bundled Chromium so a machine with no system browser can recover', () => {
+        vi.stubEnv('TEAMS_BROWSER_CHANNEL', '');
+        for (const platform of ['win32', 'darwin', 'linux']) {
+            expect(withPlatform(platform, browserChannels).at(-1)).toBeUndefined();
+        }
+    });
+    it('honours TEAMS_BROWSER_CHANNEL and disables the fallback', () => {
+        vi.stubEnv('TEAMS_BROWSER_CHANNEL', 'msedge');
+        expect(withPlatform('darwin', browserChannels)).toEqual(['msedge']);
+        vi.stubEnv('TEAMS_BROWSER_CHANNEL', 'chrome');
+        expect(withPlatform('win32', browserChannels)).toEqual(['chrome']);
+    });
+    it('ignores an unrecognised TEAMS_BROWSER_CHANNEL', () => {
+        vi.stubEnv('TEAMS_BROWSER_CHANNEL', 'safari');
+        expect(withPlatform('darwin', browserChannels)).toEqual(['chrome', 'msedge', undefined]);
+    });
+});

package/dist/tools/auth-tools.js

@@ -5,12 +5,12 @@ import { createRequire } from 'module';
 import { z } from 'zod';
 const require = createRequire(import.meta.url);
 const pkg = require('../../package.json');
-import { hasSessionState, isSessionLikelyExpired, clearAllLocalData, } from '../auth/session-store.js';
+import { hasSessionState, isSessionLikelyExpired, clearSessionState, clearTokenCache, } from '../auth/session-store.js';
 import { getSubstrateTokenStatus, getMessageAuthStatus, extractMessageAuth, extractCsaToken, extractSubstrateToken, extractSkypeSpacesToken, } from '../auth/token-extractor.js';
 import { refreshTokensViaHttp } from '../auth/token-refresh-http.js';
 import { createBrowserContext, closeBrowser } from '../browser/context.js';
 import * as log from '../utils/logger.js';
-import { resetAssignmentsAvailability, clearRegionCache } from '../utils/auth-guards.js';
+import { resetAssignmentsAvailability } from '../utils/auth-guards.js';
 import { ensureAuthenticated } from '../browser/auth.js';
 // ─────────────────────────────────────────────────────────────────────────────
 // Schemas
@@ -29,7 +29,7 @@ const loginToolDefinition = {
         properties: {
             forceNew: {
                 type: 'boolean',
-                description: 'Delete all previous login data (browser profile, cookies, saved session, every previously signed-in account) and sign in from scratch in a visible browser. Use to switch accounts or recover a broken session (default: false)',
+                description: 'Force a new login even if a session exists (default: false)',
             },
         },
     },
@@ -76,32 +76,36 @@ async function handleLogin(input) {
     // A fresh login may have changed what the account can access (e.g. new consent)
     resetAssignmentsAvailability();
     if (input.forceNew) {
-        // Start from nothing: no profile, cookies, MSAL cache or session from any
-        // earlier account can survive to be mixed into the new login.
-        clearAllLocalData();
-        clearRegionCache();
-        return loginInVisibleBrowser();
+        clearSessionState();
+        clearTokenCache();
     }
-    // Fast path: if tokens are still valid, skip browser entirely
-    const tokenStatus = getSubstrateTokenStatus();
-    if (tokenStatus.hasToken && tokenStatus.minutesRemaining >= TOKEN_VALID_THRESHOLD_MINUTES) {
-        await fillCoreCredentialGaps();
-        return {
-            success: true,
-            data: {
-                message: `Already authenticated. Token valid for ${tokenStatus.minutesRemaining} more minutes.`,
-                tokenStatus: {
-                    expiresAt: tokenStatus.expiresAt,
-                    minutesRemaining: tokenStatus.minutesRemaining,
+    else {
+        // Fast path: if tokens are still valid, skip browser entirely
+        const tokenStatus = getSubstrateTokenStatus();
+        if (tokenStatus.hasToken && tokenStatus.minutesRemaining >= TOKEN_VALID_THRESHOLD_MINUTES) {
+            await fillCoreCredentialGaps();
+            return {
+                success: true,
+                data: {
+                    message: `Already authenticated. Token valid for ${tokenStatus.minutesRemaining} more minutes.`,
+                    tokenStatus: {
+                        expiresAt: tokenStatus.expiresAt,
+                        minutesRemaining: tokenStatus.minutesRemaining,
+                    },
                 },
-            },
-        };
+            };
+        }
     }
     // Headless-first strategy:
     // The persistent browser profile retains Microsoft's long-lived session cookies,
-    // so headless SSO can succeed even without a session-state file.
+    // so headless SSO can succeed even without a session-state file. Always try
+    // headless first — even for forceNew. Most recovery scenarios complete silently.
     const headless = await createBrowserContext({ headless: true });
     try {
+        if (input.forceNew) {
+            // Clear persistent profile cookies to force fresh authentication
+            await headless.context.clearCookies();
+        }
         await ensureAuthenticated(headless.page, headless.context, (msg) => log.info('login:headless', msg), false, // No overlay in headless
         true // Headless mode - throw immediately if user interaction required
         );
@@ -118,10 +122,7 @@ async function handleLogin(input) {
         log.warn('login:headless', `Headless SSO failed, falling back to visible browser: ${error instanceof Error ? error.message : String(error)}`);
         await closeBrowser(headless, false).catch(() => { });
     }
-    return loginInVisibleBrowser();
-}
-/** Opens a visible browser for the user to sign in, then saves the session. */
-async function loginInVisibleBrowser() {
+    // Open visible browser for user interaction
     const visible = await createBrowserContext({ headless: false });
     try {
         await ensureAuthenticated(visible.page, visible.context, (msg) => log.info('login', msg));

package/dist/tools/auth-tools.test.js

@@ -2,7 +2,8 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 vi.mock('../auth/session-store.js', () => ({
     hasSessionState: vi.fn(() => true),
     isSessionLikelyExpired: vi.fn(() => false),
-    clearAllLocalData: vi.fn(),
+    clearSessionState: vi.fn(),
+    clearTokenCache: vi.fn(),
 }));
 vi.mock('../auth/token-extractor.js', () => ({
     getSubstrateTokenStatus: vi.fn(),
@@ -15,9 +16,8 @@ vi.mock('../auth/token-extractor.js', () => ({
 vi.mock('../auth/token-refresh-http.js', () => ({ refreshTokensViaHttp: vi.fn() }));
 vi.mock('../browser/context.js', () => ({ createBrowserContext: vi.fn(), closeBrowser: vi.fn() }));
 vi.mock('../browser/auth.js', () => ({ ensureAuthenticated: vi.fn() }));
-vi.mock('../utils/auth-guards.js', () => ({ resetAssignmentsAvailability: vi.fn(), clearRegionCache: vi.fn() }));
+vi.mock('../utils/auth-guards.js', () => ({ resetAssignmentsAvailability: vi.fn() }));
 import { loginTool } from './auth-tools.js';
-import { clearAllLocalData } from '../auth/session-store.js';
 import { getSubstrateTokenStatus, extractMessageAuth, extractCsaToken, extractSubstrateToken, extractSkypeSpacesToken, } from '../auth/token-extractor.js';
 import { refreshTokensViaHttp } from '../auth/token-refresh-http.js';
 import { createBrowserContext, closeBrowser } from '../browser/context.js';
@@ -49,26 +49,12 @@ describe('teams_login core credential top-up', () => {
     });
     it('tops up after a forced browser login leaves the CSA token behind', async () => {
         sessionMissingCsaToken();
-        vi.mocked(createBrowserContext).mockResolvedValue({ page: {}, context: {} });
+        vi.mocked(createBrowserContext).mockResolvedValue({ page: {}, context: { clearCookies: vi.fn() } });
         vi.mocked(closeBrowser).mockResolvedValue(undefined);
         const result = await loginTool.handler({ forceNew: true });
         expect(result.success).toBe(true);
         expect(refreshTokensViaHttp).toHaveBeenCalledOnce();
     });
-    it('forceNew wipes all previous login data and signs in from scratch in a visible browser', async () => {
-        sessionMissingCsaToken();
-        vi.mocked(extractCsaToken).mockReturnValue('csa');
-        vi.mocked(createBrowserContext).mockResolvedValue({ page: {}, context: {} });
-        vi.mocked(closeBrowser).mockResolvedValue(undefined);
-        await loginTool.handler({ forceNew: true });
-        expect(clearAllLocalData).toHaveBeenCalledOnce();
-        expect(vi.mocked(clearAllLocalData).mock.invocationCallOrder[0])
-            .toBeLessThan(vi.mocked(createBrowserContext).mock.invocationCallOrder[0]);
-        // Valid-looking tokens from the old session must not short-circuit the login,
-        // and a wiped profile has nothing for headless SSO to use.
-        expect(createBrowserContext).toHaveBeenCalledOnce();
-        expect(createBrowserContext).toHaveBeenCalledWith({ headless: false });
-    });
     it('still reports success when the top-up fails', async () => {
         sessionMissingCsaToken();
         vi.mocked(refreshTokensViaHttp).mockResolvedValue({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "msteams-mcp",
-  "version": "0.30.2",
+  "version": "0.30.3",
   "description": "MCP server for Microsoft Teams - search messages, send replies, manage favourites",
   "type": "module",
   "main": "dist/index.js",

package/dist/api/index.d.ts

@@ -1,10 +0,0 @@
-/**
- * API module exports.
- */
-export * from './substrate-api.js';
-export * from './chatsvc-api.js';
-export * from './csa-api.js';
-export * from './calendar-api.js';
-export * from './transcript-api.js';
-export * from './files-api.js';
-export * from './tags-api.js';

package/dist/api/index.js

@@ -1,10 +0,0 @@
-/**
- * API module exports.
- */
-export * from './substrate-api.js';
-export * from './chatsvc-api.js';
-export * from './csa-api.js';
-export * from './calendar-api.js';
-export * from './transcript-api.js';
-export * from './files-api.js';
-export * from './tags-api.js';

package/dist/auth/index.d.ts

@@ -1,7 +0,0 @@
-/**
- * Auth module exports.
- */
-export * from './session-store.js';
-export * from './token-extractor.js';
-export * from './token-refresh.js';
-export { encrypt, decrypt, isEncrypted, type EncryptedData } from './crypto.js';

package/dist/auth/index.js

@@ -1,7 +0,0 @@
-/**
- * Auth module exports.
- */
-export * from './session-store.js';
-export * from './token-extractor.js';
-export * from './token-refresh.js';
-export { encrypt, decrypt, isEncrypted } from './crypto.js';

package/dist/research/auth-research.d.ts

@@ -1,10 +0,0 @@
-/**
- * Research script to understand Teams authentication redirect behaviour.
- *
- * This script observes:
- * 1. What happens when navigating to Teams WITH a valid session
- * 2. What happens when navigating to Teams WITHOUT a session
- *
- * Goal: Understand the fastest way to detect if we're authenticated.
- */
-export {};

package/dist/research/auth-research.js

@@ -1,175 +0,0 @@
-/**
- * Research script to understand Teams authentication redirect behaviour.
- *
- * This script observes:
- * 1. What happens when navigating to Teams WITH a valid session
- * 2. What happens when navigating to Teams WITHOUT a session
- *
- * Goal: Understand the fastest way to detect if we're authenticated.
- */
-import { chromium } from 'playwright';
-import { hasSessionState } from '../auth/session-store.js';
-const TEAMS_URL = 'https://teams.microsoft.com';
-async function observeNavigation(page, scenario, startTime) {
-    const events = [];
-    const log = (type, url, extra) => {
-        const now = Date.now();
-        const event = {
-            timestamp: now,
-            elapsed: now - startTime,
-            type,
-            url,
-            ...extra,
-        };
-        events.push(event);
-        console.log(`  [${event.elapsed}ms] ${type}: ${url}${extra?.status ? ` (${extra.status})` : ''}${extra?.note ? ` - ${extra.note}` : ''}`);
-    };
-    // Track all frame navigations
-    page.on('framenavigated', (frame) => {
-        if (frame === page.mainFrame()) {
-            const url = frame.url();
-            const isLogin = url.includes('login.microsoftonline.com') ||
-                url.includes('login.live.com') ||
-                url.includes('login.microsoft.com');
-            const isTeams = url.includes('teams.microsoft.com') ||
-                url.includes('teams.microsoft.us');
-            log('navigation', url, {
-                note: isLogin ? 'LOGIN PAGE' : isTeams ? 'TEAMS' : undefined
-            });
-        }
-    });
-    // Track responses (especially redirects)
-    page.on('response', (response) => {
-        const url = response.url();
-        const status = response.status();
-        // Only log main document responses and redirects
-        if (response.request().resourceType() === 'document' ||
-            (status >= 300 && status < 400)) {
-            log('response', url, {
-                status,
-                note: status >= 300 && status < 400 ? 'REDIRECT' : undefined
-            });
-        }
-    });
-    return events;
-}
-async function runScenario(browser, scenario, useSession) {
-    console.log(`\n${'='.repeat(60)}`);
-    console.log(`SCENARIO: ${scenario}`);
-    console.log(`Session: ${useSession ? 'WITH existing session' : 'NO session (cleared)'}`);
-    console.log('='.repeat(60));
-    let context;
-    if (useSession && hasSessionState()) {
-        console.log('Loading existing session state...');
-        // Handle encrypted session
-        try {
-            const { readSessionState } = await import('../auth/session-store.js');
-            const state = readSessionState();
-            if (state) {
-                context = await browser.newContext({
-                    storageState: state,
-                    viewport: { width: 1280, height: 800 },
-                });
-            }
-            else {
-                throw new Error('Could not read session');
-            }
-        }
-        catch {
-            console.log('Could not load session, using fresh context');
-            context = await browser.newContext({
-                viewport: { width: 1280, height: 800 },
-            });
-        }
-    }
-    else {
-        console.log('Using fresh context (no session)...');
-        context = await browser.newContext({
-            viewport: { width: 1280, height: 800 },
-        });
-    }
-    const page = await context.newPage();
-    const startTime = Date.now();
-    console.log(`\nNavigating to ${TEAMS_URL}...`);
-    console.log('Watching for navigations and redirects:\n');
-    const events = await observeNavigation(page, scenario, startTime);
-    try {
-        // Navigate and wait for initial load
-        await page.goto(TEAMS_URL, {
-            waitUntil: 'domcontentloaded',
-            timeout: 30000,
-        });
-        const afterGoto = Date.now();
-        console.log(`\n  [${afterGoto - startTime}ms] goto() completed (domcontentloaded)`);
-        // Wait a bit more to see if any late redirects happen
-        console.log('\n  Waiting 10 seconds to observe any delayed redirects...\n');
-        for (let i = 1; i <= 10; i++) {
-            await page.waitForTimeout(1000);
-            const currentUrl = page.url();
-            const isLogin = currentUrl.includes('login.microsoftonline.com') ||
-                currentUrl.includes('login.live.com') ||
-                currentUrl.includes('login.microsoft.com');
-            const isTeams = currentUrl.includes('teams.microsoft.com') ||
-                currentUrl.includes('teams.microsoft.us');
-            console.log(`  [${Date.now() - startTime}ms] Check ${i}: ${isLogin ? 'ON LOGIN' : isTeams ? 'ON TEAMS' : 'OTHER'} - ${currentUrl.substring(0, 80)}...`);
-            // If we're on login page, we know we're not authenticated
-            if (isLogin) {
-                console.log('\n  ✓ Detected redirect to login page - NOT authenticated');
-                break;
-            }
-        }
-        const finalUrl = page.url();
-        const duration = Date.now() - startTime;
-        console.log(`\n${'─'.repeat(60)}`);
-        console.log(`RESULT for "${scenario}":`);
-        console.log(`  Final URL: ${finalUrl}`);
-        console.log(`  Total duration: ${duration}ms`);
-        console.log(`  Navigation events: ${events.length}`);
-        const isOnLogin = finalUrl.includes('login.microsoftonline.com') ||
-            finalUrl.includes('login.live.com') ||
-            finalUrl.includes('login.microsoft.com');
-        const isOnTeams = finalUrl.includes('teams.microsoft.com') ||
-            finalUrl.includes('teams.microsoft.us');
-        console.log(`  Authenticated: ${isOnTeams && !isOnLogin ? 'YES (on Teams)' : 'NO (on login page)'}`);
-        return { events, finalUrl, duration };
-    }
-    finally {
-        await context.close();
-    }
-}
-async function main() {
-    console.log('🔬 Teams Authentication Research');
-    console.log('================================\n');
-    console.log('This script observes redirect behaviour during Teams navigation.\n');
-    const browser = await chromium.launch({
-        headless: false, // Visible so we can see what's happening
-    });
-    try {
-        // Scenario 1: With existing session (if available)
-        if (hasSessionState()) {
-            await runScenario(browser, 'WITH SESSION', true);
-        }
-        else {
-            console.log('\n⚠️  No existing session found. Run `npm run cli -- login` first to create one.');
-            console.log('   Skipping "WITH SESSION" scenario.\n');
-        }
-        // Scenario 2: Without session (cleared context)
-        await runScenario(browser, 'WITHOUT SESSION', false);
-        console.log('\n\n' + '='.repeat(60));
-        console.log('SUMMARY');
-        console.log('='.repeat(60));
-        console.log(`
-Key observations to look for:
-1. How quickly does the redirect to login.microsoftonline.com happen?
-2. Does the redirect happen BEFORE or AFTER domcontentloaded?
-3. Are there any intermediate URLs?
-4. What HTTP status codes are used for redirects?
-
-Based on this, we can tune LOGIN_REDIRECT_TIMEOUT_MS in auth.ts
-`);
-    }
-    finally {
-        await browser.close();
-    }
-}
-main().catch(console.error);

package/dist/research/explore.d.ts

@@ -1,11 +0,0 @@
-/**
- * Research script to explore Teams web app behaviour.
- *
- * This script:
- * 1. Launches a browser with persistent context
- * 2. Navigates to Teams and handles authentication
- * 3. Monitors network requests to discover API endpoints
- * 4. Allows manual interaction to trigger searches
- * 5. Logs discovered endpoints and data structures
- */
-export {};