teams-cli 0.1.0__tar.gz → 0.1.2__tar.gz

{teams_cli-0.1.0 → teams_cli-0.1.2}/.github/workflows/release.yml

@@ -179,7 +179,11 @@ jobs:
         shell: bash
         run: |
           version="${GITHUB_REF_NAME#v}"
-          if curl -fsSL "https://crates.io/api/v1/crates/teams-cli/${version}" > /dev/null; then
+          response="$(curl --fail --silent --show-error --location \
+            --user-agent "teams-cli-release-workflow" \
+            "https://crates.io/api/v1/crates/teams-cli")"
+          if jq --exit-status --arg version "$version" \
+            '.versions[] | select(.num == $version)' <<< "$response" > /dev/null; then
             echo "exists=true" >> "$GITHUB_OUTPUT"
           else
             echo "exists=false" >> "$GITHUB_OUTPUT"

{teams_cli-0.1.0 → teams_cli-0.1.2}/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.1.2] - 2026-08-24
+
+### Added
+
+- Bundled the maintained multitenant teams-cli Entra public-client registration for zero-ID onboarding.
+- Added explicit `--channel-history` consent and machine-readable authentication capability metadata.
+
+### Changed
+
+- Normal login and token refresh now use only the user-consentable delegated permission baseline.
+- Diagnostics now distinguish successful Microsoft identity access from an unlicensed or unprovisioned Teams tenant.
+
+## [0.1.1] - 2026-08-24
+
+### Fixed
+
+- Made crates.io publication idempotent by checking the registry's version list with a privacy-preserving User-Agent before requesting publish credentials.
+
 ## [0.1.0] - 2026-08-24
 
 ### Added
@@ -16,4 +36,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Guided onboarding, diagnostics, completions, bounded collections, and deterministic TUI snapshots.
 - Distribution through crates.io, PyPI binary wheels, and signed GitHub release artifacts.
 
+[Unreleased]: https://github.com/rvben/teams-cli/compare/v0.1.2...HEAD
+[0.1.2]: https://github.com/rvben/teams-cli/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/rvben/teams-cli/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/rvben/teams-cli/releases/tag/v0.1.0

{teams_cli-0.1.0 → teams_cli-0.1.2}/Cargo.lock

@@ -2964,7 +2964,7 @@ dependencies = [
 
 [[package]]
 name = "teams-cli"
-version = "0.1.0"
+version = "0.1.2"
 dependencies = [
  "assert_cmd",
  "base64 0.23.1",

{teams_cli-0.1.0 → teams_cli-0.1.2}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "teams-cli"
-version = "0.1.0"
+version = "0.1.2"
 edition = "2024"
 rust-version = "1.90"
 description = "A Microsoft Teams CLI and TUI designed equally for humans and agents"

{teams_cli-0.1.0 → teams_cli-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: teams-cli
-Version: 0.1.0
+Version: 0.1.2
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
 License-File: LICENSE
@@ -57,28 +57,44 @@ Run `teams` in a terminal on first use, or start explicitly:
 teams init
 ```
 
-You need a Microsoft Entra public-client application:
+`teams-cli` includes a maintained multitenant Microsoft Entra public-client registration, so normal setup does not require creating an app or copying a client ID:
 
-1. In [Microsoft Entra app registrations](https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade), register an app for organizational accounts.
-2. Under **Authentication**, add the **Mobile and desktop applications** redirect URI `http://localhost` and enable public client flows.
-3. Under **API permissions**, add these delegated Microsoft Graph permissions (plus the standard OpenID scopes requested at sign-in):
+```console
+teams init
+```
+
+Browser PKCE is the human-friendly default. The browser talks directly to Microsoft, and the CLI never receives or stores your password. Normal sign-in requests these delegated scopes:
 
 ```text
 openid profile offline_access User.Read Team.ReadBasic.All
 Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send
-ChannelMessage.Send ChannelMessage.Read.All
+ChannelMessage.Send
+```
+
+Reading channel history is intentionally separate because `ChannelMessage.Read.All` requires administrator consent. Request it only when needed:
+
+```console
+teams auth login --channel-history
 ```
 
-Reading channel messages requires the administrator-consented `ChannelMessage.Read.All` permission. If the tenant has not granted it, Microsoft may require an administrator during sign-in. The CLI surfaces missing consent as a stable `permission_denied` error instead of silently reaching for undocumented Teams APIs.
+The CLI surfaces missing consent as a stable `permission_denied` error instead of silently reaching for undocumented Teams APIs. Tenant policy can still require an administrator to approve otherwise user-consentable permissions.
 
 Headless setup is explicit and never prompts:
 
 ```console
-teams init --client-id "$TEAMS_CLIENT_ID" --tenant organizations --no-login
+teams init --no-login
 teams auth login --device-code
 teams whoami --output json
 ```
 
+Organizations that prefer their own Entra registration can override the bundled application:
+
+```console
+teams init --client-id "$TEAMS_CLIENT_ID" --tenant organizations --no-login
+```
+
+The custom app must be a public client with `http://localhost` registered for browser login, public-client flows enabled for device-code login, and the baseline delegated permissions listed above.
+
 For short-lived automation, `TEAMS_ACCESS_TOKEN` overrides the stored credential. Refresh credentials are never written to the config file.
 
 ## Everyday commands
@@ -88,6 +104,8 @@ teams list
 teams channels list TEAM_ID
 teams chats list --limit 25
 teams messages list --chat CHAT_ID
+teams auth login --channel-history  # once, with administrator approval
+teams messages list --team TEAM_ID --channel CHANNEL_ID
 teams messages send --chat CHAT_ID --body "On it."
 printf 'Status update' | teams messages send --chat CHAT_ID --body -
 teams doctor
@@ -98,6 +116,7 @@ Collection commands expose `--limit` and `--fields`; Graph-native collections us
 ## Boundaries
 
 - Microsoft 365 work or school accounts only. The relevant Teams Graph endpoints do not support personal Microsoft accounts.
+- A work account can authenticate successfully before Microsoft Teams is licensed or provisioned; `teams doctor` distinguishes identity access from Teams availability.
 - Calling and screen sharing are not available as a delegated user CLI; Graph calling is built around bot/application scenarios.
 - No extracted desktop tokens, browser interception, or private Teams protocols.
 - Tenant policy and admin consent can restrict delegated capabilities.

{teams_cli-0.1.0 → teams_cli-0.1.2}/PRODUCT.md

@@ -29,12 +29,13 @@ A human-first and agent-first Microsoft Teams terminal client: a polished TUI an
 - Installed from PyPI, preferably with `pipx install teams-cli`, despite the implementation being Rust.
 - Invoked as `teams` alongside sibling tools such as `jira` and `confluence`.
 - Used interactively in a local terminal, non-interactively in shell pipelines, and by AI agents.
-- Authenticates a Microsoft 365 work or school account through a customer-owned Microsoft Entra public-client application.
+- Authenticates a Microsoft 365 work or school account through the maintained teams-cli Entra public-client application, with an explicit override for customer-owned registrations.
 - Opens the native or web Teams client for experiences that Microsoft Graph does not expose, such as normal user calls.
 
 ## Capabilities and Constraints
 
 - Browser-based delegated OAuth with PKCE is the preferred login; device-code flow is an explicit headless fallback.
+- Everyday commands use a user-consentable baseline; administrator-consented channel history is a deliberate login opt-in.
 - Refresh credentials must use OS-protected storage and must never be written as plaintext tokens.
 - Initial product surface covers onboarding, authentication diagnostics, identity, teams, channels, chats, messages, and the TUI foundation.
 - Commands offer human text and structured JSON output, with clean stdout/stderr separation.

{teams_cli-0.1.0 → teams_cli-0.1.2}/README.md

@@ -41,28 +41,44 @@ Run `teams` in a terminal on first use, or start explicitly:
 teams init
 ```
 
-You need a Microsoft Entra public-client application:
+`teams-cli` includes a maintained multitenant Microsoft Entra public-client registration, so normal setup does not require creating an app or copying a client ID:
 
-1. In [Microsoft Entra app registrations](https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade), register an app for organizational accounts.
-2. Under **Authentication**, add the **Mobile and desktop applications** redirect URI `http://localhost` and enable public client flows.
-3. Under **API permissions**, add these delegated Microsoft Graph permissions (plus the standard OpenID scopes requested at sign-in):
+```console
+teams init
+```
+
+Browser PKCE is the human-friendly default. The browser talks directly to Microsoft, and the CLI never receives or stores your password. Normal sign-in requests these delegated scopes:
 
 ```text
 openid profile offline_access User.Read Team.ReadBasic.All
 Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send
-ChannelMessage.Send ChannelMessage.Read.All
+ChannelMessage.Send
+```
+
+Reading channel history is intentionally separate because `ChannelMessage.Read.All` requires administrator consent. Request it only when needed:
+
+```console
+teams auth login --channel-history
 ```
 
-Reading channel messages requires the administrator-consented `ChannelMessage.Read.All` permission. If the tenant has not granted it, Microsoft may require an administrator during sign-in. The CLI surfaces missing consent as a stable `permission_denied` error instead of silently reaching for undocumented Teams APIs.
+The CLI surfaces missing consent as a stable `permission_denied` error instead of silently reaching for undocumented Teams APIs. Tenant policy can still require an administrator to approve otherwise user-consentable permissions.
 
 Headless setup is explicit and never prompts:
 
 ```console
-teams init --client-id "$TEAMS_CLIENT_ID" --tenant organizations --no-login
+teams init --no-login
 teams auth login --device-code
 teams whoami --output json
 ```
 
+Organizations that prefer their own Entra registration can override the bundled application:
+
+```console
+teams init --client-id "$TEAMS_CLIENT_ID" --tenant organizations --no-login
+```
+
+The custom app must be a public client with `http://localhost` registered for browser login, public-client flows enabled for device-code login, and the baseline delegated permissions listed above.
+
 For short-lived automation, `TEAMS_ACCESS_TOKEN` overrides the stored credential. Refresh credentials are never written to the config file.
 
 ## Everyday commands
@@ -72,6 +88,8 @@ teams list
 teams channels list TEAM_ID
 teams chats list --limit 25
 teams messages list --chat CHAT_ID
+teams auth login --channel-history  # once, with administrator approval
+teams messages list --team TEAM_ID --channel CHANNEL_ID
 teams messages send --chat CHAT_ID --body "On it."
 printf 'Status update' | teams messages send --chat CHAT_ID --body -
 teams doctor
@@ -82,6 +100,7 @@ Collection commands expose `--limit` and `--fields`; Graph-native collections us
 ## Boundaries
 
 - Microsoft 365 work or school accounts only. The relevant Teams Graph endpoints do not support personal Microsoft accounts.
+- A work account can authenticate successfully before Microsoft Teams is licensed or provisioned; `teams doctor` distinguishes identity access from Teams availability.
 - Calling and screen sharing are not available as a delegated user CLI; Graph calling is built around bot/application scenarios.
 - No extracted desktop tokens, browser interception, or private Teams protocols.
 - Tenant policy and admin consent can restrict delegated capabilities.

{teams_cli-0.1.0 → teams_cli-0.1.2}/src/auth.rs

@@ -12,7 +12,9 @@ use crate::config::Profile;
 use crate::error::AppError;
 use crate::output::Output;
 
-pub const SCOPES: &str = "openid profile offline_access User.Read Team.ReadBasic.All Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send ChannelMessage.Send ChannelMessage.Read.All";
+pub const BASE_SCOPES: &str = "openid profile offline_access User.Read Team.ReadBasic.All Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send ChannelMessage.Send";
+pub const CHANNEL_HISTORY_SCOPE: &str = "ChannelMessage.Read.All";
+pub const CHANNEL_HISTORY_SCOPES: &str = "openid profile offline_access User.Read Team.ReadBasic.All Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send ChannelMessage.Send ChannelMessage.Read.All";
 const SERVICE: &str = "teams-cli";
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -59,6 +61,28 @@ pub fn has_token(profile_name: &str) -> bool {
             .is_ok()
 }
 
+pub fn granted_scopes(profile_name: &str) -> Option<Vec<String>> {
+    if std::env::var("TEAMS_ACCESS_TOKEN").is_ok() {
+        return None;
+    }
+    load(profile_name).ok().and_then(|token| {
+        token.scope.map(|scope| {
+            scope
+                .split_whitespace()
+                .map(str::to_owned)
+                .collect::<Vec<_>>()
+        })
+    })
+}
+
+pub fn channel_history_granted(profile_name: &str) -> Option<bool> {
+    granted_scopes(profile_name).map(|scopes| {
+        scopes
+            .iter()
+            .any(|scope| scope.eq_ignore_ascii_case(CHANNEL_HISTORY_SCOPE))
+    })
+}
+
 fn store(profile_name: &str, token: &TokenBundle) -> Result<(), AppError> {
     let encoded = serde_json::to_string(token).map_err(|e| AppError::Unexpected(e.to_string()))?;
     entry(profile_name)?.set_password(&encoded).map_err(|e| {
@@ -105,7 +129,7 @@ pub async fn access_token(profile_name: &str, profile: &Profile) -> Result<Strin
             ("client_id", profile.client_id.as_str()),
             ("grant_type", "refresh_token"),
             ("refresh_token", refresh),
-            ("scope", SCOPES),
+            ("scope", bundle.scope.as_deref().unwrap_or(BASE_SCOPES)),
         ])
         .send()
         .await
@@ -123,18 +147,32 @@ pub async fn login(
     profile_name: &str,
     profile: &Profile,
     device_code: bool,
+    channel_history: bool,
     out: &Output,
 ) -> Result<TokenBundle, AppError> {
+    let scopes = scopes(channel_history);
     let bundle = if device_code {
-        device_login(profile, out).await?
+        device_login(profile, scopes, out).await?
     } else {
-        browser_login(profile, out).await?
+        browser_login(profile, scopes, out).await?
     };
     store(profile_name, &bundle)?;
     Ok(bundle)
 }
 
-async fn browser_login(profile: &Profile, out: &Output) -> Result<TokenBundle, AppError> {
+fn scopes(channel_history: bool) -> &'static str {
+    if channel_history {
+        CHANNEL_HISTORY_SCOPES
+    } else {
+        BASE_SCOPES
+    }
+}
+
+async fn browser_login(
+    profile: &Profile,
+    scopes: &str,
+    out: &Output,
+) -> Result<TokenBundle, AppError> {
     let listener = TcpListener::bind("127.0.0.1:0").await?;
     let redirect = format!("http://localhost:{}", listener.local_addr()?.port());
     let mut verifier_bytes = [0u8; 32];
@@ -156,7 +194,7 @@ async fn browser_login(profile: &Profile, out: &Output) -> Result<TokenBundle, A
         .append_pair("response_type", "code")
         .append_pair("redirect_uri", &redirect)
         .append_pair("response_mode", "query")
-        .append_pair("scope", SCOPES)
+        .append_pair("scope", scopes)
         .append_pair("code_challenge", &challenge)
         .append_pair("code_challenge_method", "S256")
         .append_pair("state", &state);
@@ -217,7 +255,7 @@ async fn browser_login(profile: &Profile, out: &Output) -> Result<TokenBundle, A
             ("code", code.as_str()),
             ("redirect_uri", redirect.as_str()),
             ("code_verifier", verifier.as_str()),
-            ("scope", SCOPES),
+            ("scope", scopes),
         ])
         .send()
         .await
@@ -235,13 +273,17 @@ struct DeviceCode {
     message: Option<String>,
 }
 
-async fn device_login(profile: &Profile, out: &Output) -> Result<TokenBundle, AppError> {
+async fn device_login(
+    profile: &Profile,
+    scopes: &str,
+    out: &Output,
+) -> Result<TokenBundle, AppError> {
     let response = reqwest::Client::new()
         .post(format!(
             "https://login.microsoftonline.com/{}/oauth2/v2.0/devicecode",
             profile.tenant
         ))
-        .form(&[("client_id", profile.client_id.as_str()), ("scope", SCOPES)])
+        .form(&[("client_id", profile.client_id.as_str()), ("scope", scopes)])
         .send()
         .await
         .map_err(|e| AppError::Unexpected(format!("sign-in service is unreachable: {e}")))?;
@@ -328,3 +370,19 @@ async fn oauth_response_error(response: reqwest::Response) -> AppError {
             .unwrap_or_else(|| format!("Microsoft sign-in failed with {status}")),
     )
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{BASE_SCOPES, CHANNEL_HISTORY_SCOPE, scopes};
+
+    #[test]
+    fn default_login_is_least_privilege() {
+        assert!(!BASE_SCOPES.contains(CHANNEL_HISTORY_SCOPE));
+        assert_eq!(scopes(false), BASE_SCOPES);
+    }
+
+    #[test]
+    fn channel_history_is_explicitly_opted_in() {
+        assert!(scopes(true).contains(CHANNEL_HISTORY_SCOPE));
+    }
+}

{teams_cli-0.1.0 → teams_cli-0.1.2}/src/cli.rs

@@ -72,7 +72,7 @@ pub enum Command {
 
 #[derive(Debug, Args)]
 pub struct InitArgs {
-    /// Public-client application (client) ID
+    /// Override the maintained teams-cli public-client application ID
     #[arg(long, env = "TEAMS_CLIENT_ID")]
     pub client_id: Option<String>,
     /// Tenant ID/domain, or `organizations`
@@ -84,14 +84,21 @@ pub struct InitArgs {
     /// Use device-code sign-in instead of browser PKCE
     #[arg(long)]
     pub device_code: bool,
+    /// Request admin-consented access to read channel history
+    #[arg(long)]
+    pub channel_history: bool,
 }
 
 #[derive(Debug, Subcommand)]
 pub enum AuthCommand {
     /// Sign in with delegated OAuth
     Login {
+        /// Use device-code sign-in for headless and remote environments
         #[arg(long)]
         device_code: bool,
+        /// Request admin-consented access to read channel history
+        #[arg(long)]
+        channel_history: bool,
     },
     /// Remove locally stored credentials
     Logout,

{teams_cli-0.1.0 → teams_cli-0.1.2}/src/config.rs

@@ -5,6 +5,10 @@ use serde::{Deserialize, Serialize};
 
 use crate::error::AppError;
 
+/// The maintained, multitenant public-client registration shipped with teams-cli.
+pub const DEFAULT_CLIENT_ID: &str = "66ebad71-1604-48fc-a086-0d4caa24988b";
+pub const DEFAULT_TENANT: &str = "organizations";
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Profile {
     pub client_id: String,
@@ -13,7 +17,7 @@ pub struct Profile {
 }
 
 fn default_tenant() -> String {
-    "organizations".into()
+    DEFAULT_TENANT.into()
 }
 
 #[derive(Debug, Default, Serialize, Deserialize)]

{teams_cli-0.1.0 → teams_cli-0.1.2}/src/graph.rs

@@ -47,6 +47,12 @@ impl GraphClient {
             .await
     }
 
+    pub async fn teams_available(&self) -> Result<(), AppError> {
+        self.get_value(&format!("{GRAPH}/me/joinedTeams"))
+            .await
+            .map(|_| ())
+    }
+
     pub async fn channels(&self, team: &str, limit: u16, offset: usize) -> Result<Page, AppError> {
         self.get_offset_page(
             &format!(
@@ -242,15 +248,33 @@ impl GraphClient {
             .unwrap_or("Microsoft Graph rejected the request");
         match status.as_u16() {
             401 => Err(AppError::Auth(format!("{message}; run `teams auth login`"))),
-            403 => Err(AppError::Permission(format!(
-                "{message}; check delegated scopes and tenant consent with `teams doctor`"
-            ))),
+            403 => Err(permission_error(message)),
             404 => Err(AppError::NotFound(message.into())),
             _ => Err(AppError::Api(format!("{message} ({status})"))),
         }
     }
 }
 
+fn permission_error(message: &str) -> AppError {
+    let message = message.trim();
+    let lower = message.to_ascii_lowercase();
+    let hint = if lower.contains("hasn't been provisioned")
+        || lower.contains("has not been provisioned")
+        || lower.contains("valid office365 subscription")
+        || lower.contains("valid microsoft 365 subscription")
+    {
+        "sign in with a work or school account that has Microsoft Teams enabled"
+    } else {
+        "check delegated scopes and tenant consent with `teams doctor`"
+    };
+    let separator = if matches!(message.chars().last(), Some('.' | '!' | '?')) {
+        " "
+    } else {
+        "; "
+    };
+    AppError::Permission(format!("{message}{separator}{hint}"))
+}
+
 fn is_graph_url(raw: &str) -> bool {
     url::Url::parse(raw).is_ok_and(|url| {
         url.scheme() == "https"
@@ -305,4 +329,17 @@ mod tests {
             "http://graph.microsoft.com/v1.0/me/chats"
         ));
     }
+
+    #[test]
+    fn unprovisioned_tenants_get_a_teams_specific_hint() {
+        let error = super::permission_error(
+            "Microsoft Teams hasn't been provisioned on the tenant. Ensure the tenant has a valid Office365 subscription.",
+        );
+        assert!(
+            error
+                .to_string()
+                .contains("account that has Microsoft Teams enabled")
+        );
+        assert!(!error.to_string().contains(".;"));
+    }
 }

{teams_cli-0.1.0 → teams_cli-0.1.2}/src/main.rs

@@ -1,4 +1,4 @@
-use std::io::{self, IsTerminal, Read, Write};
+use std::io::{self, IsTerminal, Read};
 
 use clap::{CommandFactory, Parser};
 use serde::Serialize;
@@ -59,6 +59,7 @@ async fn dispatch(cli: Cli, out: Output) -> Result<(), AppError> {
                 tenant: "organizations".into(),
                 no_login: false,
                 device_code: false,
+                channel_history: false,
             })
         }
         None if io::stdin().is_terminal() && io::stdout().is_terminal() => Command::Tui(TuiArgs {
@@ -178,24 +179,13 @@ async fn init(profile_name: &str, args: InitArgs, out: Output) -> Result<(), App
     let interactive = io::stdin().is_terminal() && io::stderr().is_terminal();
     if interactive && !out.json() {
         eprintln!("\n  teams\n  Microsoft Teams, without leaving your flow.\n");
-        eprintln!("  Before we sign in, create a Microsoft Entra public-client app.");
-        eprintln!(
-            "  1. Open https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade"
-        );
-        eprintln!("  2. Register a multitenant app for organizational accounts.");
-        eprintln!("  3. Add Mobile and desktop redirect URI: http://localhost");
-        eprintln!(
-            "  4. Enable public client flows and grant the delegated permissions in README.md."
-        );
-        eprintln!(
-            "  Work or school accounts are supported; personal Microsoft accounts are not.\n"
-        );
+        eprintln!("  We’ll open Microsoft sign-in in your browser.");
+        eprintln!("  No password or client secret is shared with teams-cli.");
+        eprintln!("  Work or school accounts are supported; personal accounts are not.\n");
     }
-    let client_id = match args.client_id {
-        Some(value) => value,
-        None if interactive => prompt("Application (client) ID")?,
-        None => return Err(AppError::NonInteractive("--client-id is required without a terminal; example: `teams init --client-id <uuid> --no-login`".into())),
-    };
+    let client_id = args
+        .client_id
+        .unwrap_or_else(|| config::DEFAULT_CLIENT_ID.into());
     if client_id.trim().is_empty() {
         return Err(AppError::InvalidInput("client ID cannot be empty".into()));
     }
@@ -207,14 +197,21 @@ async fn init(profile_name: &str, args: InitArgs, out: Output) -> Result<(), App
     let path = config::save(
         profile_name,
         Profile {
-            client_id,
-            tenant: args.tenant,
+            client_id: client_id.clone(),
+            tenant: args.tenant.clone(),
         },
     )?;
     let mut signed_in = false;
     if !args.no_login {
         let (_, profile) = config::load(Some(profile_name))?;
-        auth::login(profile_name, &profile, args.device_code, &out).await?;
+        auth::login(
+            profile_name,
+            &profile,
+            args.device_code,
+            args.channel_history,
+            &out,
+        )
+        .await?;
         signed_in = true;
     }
     #[derive(Serialize)]
@@ -222,11 +219,17 @@ async fn init(profile_name: &str, args: InitArgs, out: Output) -> Result<(), App
         profile: &'a str,
         config_path: String,
         signed_in: bool,
+        client_id: &'a str,
+        tenant: &'a str,
+        channel_history_requested: bool,
     }
     let result = InitResult {
         profile: profile_name,
         config_path: path.display().to_string(),
         signed_in,
+        client_id: &client_id,
+        tenant: &args.tenant,
+        channel_history_requested: args.channel_history,
     };
     out.value(&result, || {
         if signed_in {
@@ -243,7 +246,10 @@ async fn auth_command(
     out: Output,
 ) -> Result<(), AppError> {
     match command {
-        AuthCommand::Login { device_code } => {
+        AuthCommand::Login {
+            device_code,
+            channel_history,
+        } => {
             if !device_code && (!io::stdin().is_terminal() || !io::stderr().is_terminal()) {
                 return Err(AppError::NonInteractive(
                     "browser sign-in requires a terminal; use `teams auth login --device-code` for headless sign-in"
@@ -251,8 +257,8 @@ async fn auth_command(
                 ));
             }
             let (name, profile) = config::load(profile_arg)?;
-            let token = auth::login(&name, &profile, device_code, &out).await?;
-            let value = serde_json::json!({"profile":name,"expires_at":token.expires_at,"scope":token.scope});
+            let token = auth::login(&name, &profile, device_code, channel_history, &out).await?;
+            let value = serde_json::json!({"profile":name,"expires_at":token.expires_at,"scope":token.scope,"channel_history_requested":channel_history});
             out.value(&value, || format!("Signed in profile '{name}'."))
         }
         AuthCommand::Logout => {
@@ -268,12 +274,15 @@ async fn auth_command(
                 .map(|(n, _)| n.as_str())
                 .unwrap_or(profile_arg.unwrap_or("default"));
             let signed_in = auth::has_token(name);
-            let value = serde_json::json!({"profile":name,"configured":configured.is_some(),"signed_in":signed_in,"config_path":config::path()});
+            let scopes = auth::granted_scopes(name);
+            let channel_history = auth::channel_history_granted(name);
+            let value = serde_json::json!({"profile":name,"configured":configured.is_some(),"signed_in":signed_in,"config_path":config::path(),"granted_scopes":scopes,"channel_history":channel_history});
             out.value(&value, || {
                 format!(
-                    "Profile: {name}\nConfigured: {}\nSigned in: {}\nConfig: {}",
+                    "Profile: {name}\nConfigured: {}\nSigned in: {}\nChannel history: {}\nConfig: {}",
                     yes_no(configured.is_some()),
                     yes_no(signed_in),
+                    optional_access(channel_history),
                     config::path().display()
                 )
             })
@@ -401,32 +410,71 @@ async fn doctor(profile_arg: Option<&str>, out: Output) -> Result<(), AppError>
             "run `teams auth login`".into()
         },
     });
-    let mut graph_ok = false;
-    let detail = if configured.is_some() && signed_in {
+    let channel_history = auth::channel_history_granted(
+        configured
+            .as_ref()
+            .map(|(name, _)| name.as_str())
+            .unwrap_or("default"),
+    );
+    checks.push(Check {
+        name: "channel_history",
+        status: if channel_history == Some(true) {
+            "pass"
+        } else {
+            "optional"
+        },
+        detail: if channel_history == Some(true) {
+            "admin-consented channel reading is available".into()
+        } else {
+            "optional; run `teams auth login --channel-history` if an admin approves it".into()
+        },
+    });
+    let mut identity_ok = false;
+    let mut teams_ok = false;
+    let (identity_detail, teams_detail) = if configured.is_some() && signed_in {
         match client(profile_arg).await {
-            Ok(client) => match client.me().await {
-                Ok(value) => {
-                    graph_ok = true;
-                    format!(
-                        "signed in as {}",
-                        string_at(&value, "/userPrincipalName")
-                            .or_else(|| string_at(&value, "/displayName"))
-                            .unwrap_or("unknown user")
-                    )
-                }
-                Err(error) => error.to_string(),
-            },
-            Err(error) => error.to_string(),
+            Ok(client) => {
+                let identity_detail = match client.me().await {
+                    Ok(value) => {
+                        identity_ok = true;
+                        format!(
+                            "signed in as {}",
+                            string_at(&value, "/userPrincipalName")
+                                .or_else(|| string_at(&value, "/displayName"))
+                                .unwrap_or("unknown user")
+                        )
+                    }
+                    Err(error) => error.to_string(),
+                };
+                let teams_detail = match client.teams_available().await {
+                    Ok(_) => {
+                        teams_ok = true;
+                        "Microsoft Teams is available".into()
+                    }
+                    Err(error) => error.to_string(),
+                };
+                (identity_detail, teams_detail)
+            }
+            Err(error) => {
+                let detail = error.to_string();
+                (detail.clone(), detail)
+            }
         }
     } else {
-        "skipped until setup is complete".into()
+        let detail = "skipped until setup is complete".to_string();
+        (detail.clone(), detail)
     };
     checks.push(Check {
-        name: "microsoft_graph",
-        status: if graph_ok { "pass" } else { "fail" },
-        detail,
+        name: "microsoft_identity",
+        status: if identity_ok { "pass" } else { "fail" },
+        detail: identity_detail,
+    });
+    checks.push(Check {
+        name: "microsoft_teams",
+        status: if teams_ok { "pass" } else { "fail" },
+        detail: teams_detail,
     });
-    let healthy = checks.iter().all(|check| check.status == "pass");
+    let healthy = checks.iter().all(|check| check.status != "fail");
     let value = serde_json::json!({"checks":checks,"healthy":healthy});
     out.value(&value, || {
         checks
@@ -443,19 +491,11 @@ fn capabilities(out: Output) -> Result<(), AppError> {
         "unsupported":["personal Microsoft accounts","user calls and screen sharing","private Teams protocols","tenant administration"],
         "account_types":["Microsoft 365 work or school"],
         "api":"Microsoft Graph v1.0",
-        "notes":["Reading channel messages can require admin consent for ChannelMessage.Read.All.","Calls require bot/application APIs and are outside this user client."]
+        "notes":["Normal sign-in uses only user-consentable delegated permissions.","Reading channel messages requires `teams auth login --channel-history` and admin consent for ChannelMessage.Read.All.","Calls require bot/application APIs and are outside this user client."]
     });
     out.value(&value, || "Supported\n  Work/school delegated sign-in; teams, channels, chats, messages; send as yourself; TUI\n\nNot supported\n  Personal Microsoft accounts; calls or screen sharing; private Teams protocols; tenant administration\n\nRun `teams schema` for the machine contract.".into())
 }
 
-fn prompt(label: &str) -> Result<String, AppError> {
-    eprint!("  {label}: ");
-    io::stderr().flush()?;
-    let mut value = String::new();
-    io::stdin().read_line(&mut value)?;
-    Ok(value.trim().into())
-}
-
 fn read_body(body: &str) -> Result<String, AppError> {
     if body != "-" {
         return Ok(body.into());
@@ -471,6 +511,13 @@ fn string_at<'a>(value: &'a Value, pointer: &str) -> Option<&'a str> {
 fn yes_no(value: bool) -> &'static str {
     if value { "yes" } else { "no" }
 }
+fn optional_access(value: Option<bool>) -> &'static str {
+    match value {
+        Some(true) => "granted",
+        Some(false) => "not granted (optional)",
+        None => "unknown",
+    }
+}
 fn identity_text(value: &Value) -> String {
     format!(
         "{}\n{}",

{teams_cli-0.1.0 → teams_cli-0.1.2}/src/schema.rs

@@ -11,6 +11,9 @@ fn array_field(name: &str, item_kind: &str) -> Value {
 fn nullable_field(name: &str, kind: &str) -> Value {
     json!({"name": name, "type": kind, "nullable": true})
 }
+fn nullable_array_field(name: &str, item_kind: &str) -> Value {
+    json!({"name": name, "type": "array", "items": {"type": item_kind}, "nullable": true})
+}
 fn arg(name: &str, kind: &str, description: &str) -> Value {
     json!({"name": name, "type": kind, "description": description})
 }
@@ -67,17 +70,29 @@ pub fn generate(command_filter: Option<&str>) -> Value {
                     field("profile", "string"),
                     field("config_path", "string"),
                     field("signed_in", "boolean"),
+                    field("client_id", "string"),
+                    field("tenant", "string"),
+                    field("channel_history_requested", "boolean"),
                 ],
             );
             value["args"] = json!([
-                arg("--client-id", "string", "Public-client application ID"),
+                arg(
+                    "--client-id",
+                    "string",
+                    "Override the maintained teams-cli public-client application ID"
+                ),
                 arg("--tenant", "string", "Tenant ID, domain, or organizations"),
                 arg(
                     "--no-login",
                     "boolean",
                     "Save configuration without signing in"
                 ),
-                arg("--device-code", "boolean", "Use device-code sign-in")
+                arg("--device-code", "boolean", "Use device-code sign-in"),
+                arg(
+                    "--channel-history",
+                    "boolean",
+                    "Request admin-consented channel-history access"
+                )
             ]);
             value
         },
@@ -90,9 +105,21 @@ pub fn generate(command_filter: Option<&str>) -> Value {
                     field("profile", "string"),
                     field("expires_at", "integer"),
                     nullable_field("scope", "string"),
+                    field("channel_history_requested", "boolean"),
                 ],
             );
-            value["args"] = json!([arg("--device-code", "boolean", "Use device-code sign-in")]);
+            value["args"] = json!([
+                arg(
+                    "--device-code",
+                    "boolean",
+                    "Use device-code sign-in for headless and remote environments"
+                ),
+                arg(
+                    "--channel-history",
+                    "boolean",
+                    "Request admin-consented channel-history access"
+                )
+            ]);
             value
         },
         single(
@@ -110,6 +137,8 @@ pub fn generate(command_filter: Option<&str>) -> Value {
                 field("configured", "boolean"),
                 field("signed_in", "boolean"),
                 field("config_path", "string"),
+                nullable_array_field("granted_scopes", "string"),
+                nullable_field("channel_history", "boolean"),
             ],
         ),
         single(
@@ -157,7 +186,7 @@ pub fn generate(command_filter: Option<&str>) -> Value {
         {
             let mut value = paged(
                 "messages list",
-                "List messages from one chat or channel",
+                "List messages from one chat, or from a channel with optional admin-consented access",
                 vec![
                     field("id", "string"),
                     field("createdDateTime", "string"),
@@ -198,7 +227,7 @@ pub fn generate(command_filter: Option<&str>) -> Value {
         json!({"name":"tui", "description":"Open the keyboard-first terminal interface", "effects":"read_only", "output_kind":"opaque", "media_type":"text/plain", "requires_tty":true, "args":[arg("--demo", "boolean", "Use deterministic sample data"), arg("--snapshot", "boolean", "Print one ANSI-free demo frame")]}),
         single(
             "doctor",
-            "Check configuration, credential storage, and Graph access",
+            "Check configuration, credential storage, Microsoft identity, and Teams provisioning",
             "read_only",
             vec![array_field("checks", "object"), field("healthy", "boolean")],
         ),
@@ -241,6 +270,13 @@ pub fn generate(command_filter: Option<&str>) -> Value {
         ],
         "commands": commands,
         "errors": error::ALL.iter().map(|e| json!({"kind":e.kind,"exit_code":e.exit_code,"retryable":e.retryable,"description":e.description})).collect::<Vec<_>>(),
-        "extensions": {"authentication":"delegated_oauth", "api":"Microsoft Graph v1.0"}
+        "extensions": {
+            "authentication":"delegated_oauth",
+            "api":"Microsoft Graph v1.0",
+            "default_client_id": crate::config::DEFAULT_CLIENT_ID,
+            "login_modes":["browser_pkce","device_code"],
+            "baseline_scopes": crate::auth::BASE_SCOPES.split_whitespace().collect::<Vec<_>>(),
+            "privileged_scopes":[crate::auth::CHANNEL_HISTORY_SCOPE]
+        }
     })
 }

{teams_cli-0.1.0 → teams_cli-0.1.2}/tests/cli.rs

@@ -106,13 +106,20 @@ fn no_args_never_prompts_when_piped() {
 }
 
 #[test]
-fn noninteractive_init_requires_client_id() {
-    Command::cargo_bin("teams")
+fn noninteractive_init_uses_the_maintained_client_id() {
+    let temp = tempfile::tempdir().unwrap();
+    let output = Command::cargo_bin("teams")
         .unwrap()
+        .env("XDG_CONFIG_HOME", temp.path())
         .args(["init", "--no-login"])
-        .assert()
-        .code(8)
-        .stderr(predicate::str::contains("--client-id is required"));
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    let result: Value = serde_json::from_slice(&output.stdout).unwrap();
+    assert_eq!(result["client_id"], "66ebad71-1604-48fc-a086-0d4caa24988b");
+    assert_eq!(result["tenant"], "organizations");
+    assert_eq!(result["channel_history_requested"], false);
+    assert!(temp.path().join("teams/config.toml").is_file());
 }
 
 #[test]
@@ -121,11 +128,7 @@ fn headless_browser_login_refuses_before_writing_config() {
     Command::cargo_bin("teams")
         .unwrap()
         .env("XDG_CONFIG_HOME", temp.path())
-        .args([
-            "init",
-            "--client-id",
-            "00000000-0000-0000-0000-000000000000",
-        ])
+        .arg("init")
         .assert()
         .code(8)
         .stderr(predicate::str::contains(
@@ -133,3 +136,29 @@ fn headless_browser_login_refuses_before_writing_config() {
         ));
     assert!(!temp.path().join("teams/config.toml").exists());
 }
+
+#[test]
+fn schema_declares_default_app_and_privileged_scope() {
+    let output = Command::cargo_bin("teams")
+        .unwrap()
+        .arg("schema")
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    let schema: Value = serde_json::from_slice(&output.stdout).unwrap();
+    assert_eq!(
+        schema["extensions"]["default_client_id"],
+        "66ebad71-1604-48fc-a086-0d4caa24988b"
+    );
+    assert!(
+        schema["extensions"]["baseline_scopes"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .all(|scope| scope != "ChannelMessage.Read.All")
+    );
+    assert_eq!(
+        schema["extensions"]["privileged_scopes"],
+        serde_json::json!(["ChannelMessage.Read.All"])
+    );
+}