teams-cli 0.2.0__tar.gz → 0.2.1__tar.gz

{teams_cli-0.2.0 → teams_cli-0.2.1}/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.1](https://github.com/rvben/teams-cli/compare/v0.2.0...v0.2.1) - 2026-10-15
+
+### Added
+
+- **desktop**: add `teams desktop clear-flags` and a confirmed TUI cleanup that remove remote-debugging flags from the user-wide WebView2 setting while keeping its other arguments.
+- Search people by name or email and create or reuse a one-to-one conversation with `people search` and `chats create --recipient ID --yes`. Opening a conversation never sends a message.
+- Support these operations through the selected personal or work/school desktop account and through Microsoft Graph. Graph search requires a new sign-in to consent to `User.ReadBasic.All`.
+
+### Changed
+
+- Windows desktop helpers use protocol 4. WSL requires the helper from the same CLI release.
+- Ambiguous conversation-creation outcomes remain unconfirmed and are never automatically retried.
+- Personal-account searches put verified live matches first and filter unrelated recent-contact suggestions before applying the result limit.
+
+### Fixed
+
+- **desktop**: pass the debugging flags only to the Teams launch on Windows and WSL, so other WebView2 apps such as Outlook no longer open the debugging port.
+- **desktop**: name the application that holds a refused port and report a user-wide debugging setting as the cause.
+- **desktop**: recognise the dedicated browser on Linux and WSL when Chrome rewrites its process title, so setup no longer stops with "did not open its debugging endpoint"; recovery hints now name the browser mode and port in use.
+- **desktop**: keep the work/school browser visible when the organisation's sign-in (such as AD FS with Windows sign-in) does not let Teams stay signed in headless, instead of reporting success and then losing the session; reads now say when Teams was sent back to sign-in, and setup reports whether the browser runs headless or visible.
+- **desktop**: stop a verified dedicated browser that hangs after closing its debugging port, so disconnect and recover no longer leave it running.
+- **desktop**: refuse sign-in success when the browser closes or loses verified ownership during the sign-in check, and verify reads again after observing work-account sign-in.
+- **desktop**: separate email lookup from name search ([b0647f1](https://github.com/rvben/teams-cli/commit/b0647f177c3f4cb5f73e74f42aed11078832e632))
+
 ## [0.2.0](https://github.com/rvben/teams-cli/compare/v0.1.13...v0.2.0) - 2026-10-14
 
 ### Added

{teams_cli-0.2.0 → teams_cli-0.2.1}/Cargo.lock

@@ -3187,7 +3187,7 @@ dependencies = [
 
 [[package]]
 name = "teams-cli"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
  "assert_cmd",
  "base64 0.23.1",

{teams_cli-0.2.0 → teams_cli-0.2.1}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "teams-cli"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2024"
 rust-version = "1.90"
 description = "A Microsoft Teams CLI and TUI designed equally for humans and agents"
@@ -56,10 +56,11 @@ windows-sys = { version = "0.61", features = [
     "Win32_Security",
     "Win32_Storage_Packaging_Appx",
     "Win32_System_Diagnostics_ToolHelp",
+    "Win32_System_Registry",
     "Win32_System_Threading",
 ] }
 
-[target.'cfg(target_os = "macos")'.dependencies]
+[target.'cfg(unix)'.dependencies]
 libc = "0.2"
 
 [dev-dependencies]

{teams_cli-0.2.0 → teams_cli-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: teams-cli
-Version: 0.2.0
+Version: 0.2.1
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
 License-File: LICENSE
@@ -81,8 +81,8 @@ for sending, reconnecting, and experimental compatibility limits.
 Browser PKCE is the human-friendly default. The browser talks directly to Microsoft, and the CLI never receives or stores your password. Normal sign-in requests these delegated scopes:
 
 ```text
-openid profile offline_access User.Read Team.ReadBasic.All
-Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send
+openid profile offline_access User.Read User.ReadBasic.All
+Team.ReadBasic.All Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send
 ChannelMessage.Send
 ```
 
@@ -163,6 +163,8 @@ For short-lived automation, `TEAMS_ACCESS_TOKEN` overrides the stored credential
 teams list
 teams channels list TEAM_ID
 teams chats list --limit 25
+teams people search "Alex" --limit 20
+teams chats create --recipient PERSON_ID --yes  # no message is sent
 teams messages list --chat CHAT_ID
 teams auth login --channel-history  # once, with administrator approval
 teams messages list --team TEAM_ID --channel CHANNEL_ID
@@ -178,7 +180,21 @@ teams config path
 teams doctor --offline
 ```
 
-Collection commands expose `--limit` and `--fields`; Graph-native collections use `--cursor`, while joined teams and channels use `--offset` because those endpoints do not accept `$top`. With a terminal they render concise text; when stdout is piped they emit JSON envelopes with continuation metadata and `truncated`.
+Chat, message, team and channel collections expose `--limit` and `--fields`; Graph-native collections use `--cursor`, while joined teams and channels use `--offset` because those endpoints do not accept `$top`. With a terminal they render concise text; when stdout is piped they emit JSON envelopes with continuation metadata and `truncated`.
+
+To message someone for the first time, use `people search` to find their verified
+identity in the active profile. Search accepts a name or email prefix of 2–256
+characters and returns at most 50 people; refine the query if `truncated` is true.
+Pass the exact returned ID to `chats create`, then pass the resulting chat ID to
+`messages send`. Creating a conversation reuses an existing one-to-one chat when
+available and sends no message. It requires a writable profile and confirmation
+(`--yes` for automation). Recipient IDs belong to their selected account/backend.
+If creation is unconfirmed, inspect your chats before trying again.
+
+Graph recipient search needs delegated `User.ReadBasic.All` consent. Existing
+sign-ins can keep reading chats; run `teams auth login` again to enable directory
+search. Your organization may restrict consent, directory guest access, external
+recipients or chat creation. Personal accounts use the desktop backend.
 
 Profiles can block every remote write while keeping reads, sign-in, diagnostics, and the TUI available:
 
@@ -273,7 +289,9 @@ paste; `r` checks delivery, `s` offers an explicit second-copy confirmation, and
 `esc` keeps the draft and uncertainty together in memory. Reopening it does not
 unlock ordinary sending. Queued results are labelled queued rather than sent.
 
-Desktop cannot create new chats. Teams, channels, identity commands, subscriptions,
+Desktop supports people search and one-to-one chat creation through the selected
+Teams client's own session. Creation requires a profile with `--allow-send` and
+sends no message. Teams, channels, identity commands, subscriptions,
 replies, mentions, attachments and edits return `unsupported` on desktop. The TUI
 reads chats from the same cache and sends through the same path as `messages send`.
 Existing profiles without a backend field
@@ -295,15 +313,22 @@ Added auxiliary processes are left alone. If Teams was
 restarted independently, quit and relaunch it normally, then disconnect again to
 clear the old record. No command automatically restarts Teams on exit.
 
-On macOS, flags apply only to the managed launch. On Windows/WSL, setup saves the
-previous user environment value, applies flags temporarily while Teams starts, then
-restores that value. Unrelated changes to the value are preserved and reported.
+Debugging flags apply only to the managed Teams launch; other apps and the user
+environment are left unchanged. On Windows/WSL, Teams starts through its
+`ms-teams.exe` app execution alias, which must be enabled (Settings > Apps >
+Advanced app settings > App execution aliases). Connect refuses a user-wide
+`WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS` that already has debugging flags: such a
+setting opens the port in every WebView2 app, for example Outlook, and the
+listener is then refused because Teams does not own it. Errors name those apps.
+`teams desktop clear-flags` removes only the debugging flags from that setting
+after confirmation (`--yes` when scripted); quit and reopen the named apps
+afterwards. The TUI offers the same cleanup.
 Windows and WSL share a recovery record and lock. WSL finds PowerShell in its normal
 Windows system directory even when Windows PATH entries are disabled; Windows
 executable interop must still be enabled.
 
-If setup is interrupted, run `teams --profile local desktop recover`. It restores
-pending settings without restarting Teams or requiring the Windows helper; it does
+If setup is interrupted, run `teams --profile local desktop recover`. It clears the
+interrupted record (and restores settings left by older versions) without restarting Teams or requiring the Windows helper; it does
 not claim ownership of an unrecorded Teams process. Use `desktop status` to inspect
 the endpoint and saved session. Recovery cannot close an already-running debugging
 endpoint: quit Teams and relaunch it normally if its ownership was not recorded.
@@ -403,6 +428,13 @@ A sign-in timeout leaves the visible window open; finish signing in and retry
 `desktop login`. Interrupting login preserves the browser and its saved profile.
 On WSL2, the visible step needs WSLg or another graphical display.
 
+Some organisations sign in through their own identity provider (for example AD FS
+with Windows sign-in) and do not let Teams renew its sign-in in a headless browser.
+For work/school accounts, login therefore watches the headless browser for up to a
+minute; when Teams is sent back to sign-in, the visible browser is reopened and stays
+open instead. Minimise that window, but keep it open. When a headless session is sent
+back to sign-in later, reads report it; run `desktop login` again.
+
 Use `--desktop-account personal` for a personal Microsoft account. Sending still
 requires an explicit `init --allow-send` and the existing send confirmation.
 `init --no-login` only saves configuration. `desktop connect --visible` remains
@@ -413,7 +445,8 @@ The browser uses its own profile under the local data directory at
 profile. Different ports use different browser profiles. Disconnect closes this
 browser and keeps its sign-in data. To switch between visible and headless operation,
 disconnect first. `desktop recover` closes a verified managed browser or clears a
-stale record when no listener remains. Unverifiable processes are left untouched.
+stale record when no listener remains. A verified browser that does not exit after
+closing its debugging port is stopped; unverifiable processes are left untouched.
 
 The CLI checks that every listener is loopback-only and belongs to the recorded
 browser process, running as you with the expected executable, debugging port and

{teams_cli-0.2.0 → teams_cli-0.2.1}/README.md

@@ -65,8 +65,8 @@ for sending, reconnecting, and experimental compatibility limits.
 Browser PKCE is the human-friendly default. The browser talks directly to Microsoft, and the CLI never receives or stores your password. Normal sign-in requests these delegated scopes:
 
 ```text
-openid profile offline_access User.Read Team.ReadBasic.All
-Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send
+openid profile offline_access User.Read User.ReadBasic.All
+Team.ReadBasic.All Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send
 ChannelMessage.Send
 ```
 
@@ -147,6 +147,8 @@ For short-lived automation, `TEAMS_ACCESS_TOKEN` overrides the stored credential
 teams list
 teams channels list TEAM_ID
 teams chats list --limit 25
+teams people search "Alex" --limit 20
+teams chats create --recipient PERSON_ID --yes  # no message is sent
 teams messages list --chat CHAT_ID
 teams auth login --channel-history  # once, with administrator approval
 teams messages list --team TEAM_ID --channel CHANNEL_ID
@@ -162,7 +164,21 @@ teams config path
 teams doctor --offline
 ```
 
-Collection commands expose `--limit` and `--fields`; Graph-native collections use `--cursor`, while joined teams and channels use `--offset` because those endpoints do not accept `$top`. With a terminal they render concise text; when stdout is piped they emit JSON envelopes with continuation metadata and `truncated`.
+Chat, message, team and channel collections expose `--limit` and `--fields`; Graph-native collections use `--cursor`, while joined teams and channels use `--offset` because those endpoints do not accept `$top`. With a terminal they render concise text; when stdout is piped they emit JSON envelopes with continuation metadata and `truncated`.
+
+To message someone for the first time, use `people search` to find their verified
+identity in the active profile. Search accepts a name or email prefix of 2–256
+characters and returns at most 50 people; refine the query if `truncated` is true.
+Pass the exact returned ID to `chats create`, then pass the resulting chat ID to
+`messages send`. Creating a conversation reuses an existing one-to-one chat when
+available and sends no message. It requires a writable profile and confirmation
+(`--yes` for automation). Recipient IDs belong to their selected account/backend.
+If creation is unconfirmed, inspect your chats before trying again.
+
+Graph recipient search needs delegated `User.ReadBasic.All` consent. Existing
+sign-ins can keep reading chats; run `teams auth login` again to enable directory
+search. Your organization may restrict consent, directory guest access, external
+recipients or chat creation. Personal accounts use the desktop backend.
 
 Profiles can block every remote write while keeping reads, sign-in, diagnostics, and the TUI available:
 
@@ -257,7 +273,9 @@ paste; `r` checks delivery, `s` offers an explicit second-copy confirmation, and
 `esc` keeps the draft and uncertainty together in memory. Reopening it does not
 unlock ordinary sending. Queued results are labelled queued rather than sent.
 
-Desktop cannot create new chats. Teams, channels, identity commands, subscriptions,
+Desktop supports people search and one-to-one chat creation through the selected
+Teams client's own session. Creation requires a profile with `--allow-send` and
+sends no message. Teams, channels, identity commands, subscriptions,
 replies, mentions, attachments and edits return `unsupported` on desktop. The TUI
 reads chats from the same cache and sends through the same path as `messages send`.
 Existing profiles without a backend field
@@ -279,15 +297,22 @@ Added auxiliary processes are left alone. If Teams was
 restarted independently, quit and relaunch it normally, then disconnect again to
 clear the old record. No command automatically restarts Teams on exit.
 
-On macOS, flags apply only to the managed launch. On Windows/WSL, setup saves the
-previous user environment value, applies flags temporarily while Teams starts, then
-restores that value. Unrelated changes to the value are preserved and reported.
+Debugging flags apply only to the managed Teams launch; other apps and the user
+environment are left unchanged. On Windows/WSL, Teams starts through its
+`ms-teams.exe` app execution alias, which must be enabled (Settings > Apps >
+Advanced app settings > App execution aliases). Connect refuses a user-wide
+`WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS` that already has debugging flags: such a
+setting opens the port in every WebView2 app, for example Outlook, and the
+listener is then refused because Teams does not own it. Errors name those apps.
+`teams desktop clear-flags` removes only the debugging flags from that setting
+after confirmation (`--yes` when scripted); quit and reopen the named apps
+afterwards. The TUI offers the same cleanup.
 Windows and WSL share a recovery record and lock. WSL finds PowerShell in its normal
 Windows system directory even when Windows PATH entries are disabled; Windows
 executable interop must still be enabled.
 
-If setup is interrupted, run `teams --profile local desktop recover`. It restores
-pending settings without restarting Teams or requiring the Windows helper; it does
+If setup is interrupted, run `teams --profile local desktop recover`. It clears the
+interrupted record (and restores settings left by older versions) without restarting Teams or requiring the Windows helper; it does
 not claim ownership of an unrecorded Teams process. Use `desktop status` to inspect
 the endpoint and saved session. Recovery cannot close an already-running debugging
 endpoint: quit Teams and relaunch it normally if its ownership was not recorded.
@@ -387,6 +412,13 @@ A sign-in timeout leaves the visible window open; finish signing in and retry
 `desktop login`. Interrupting login preserves the browser and its saved profile.
 On WSL2, the visible step needs WSLg or another graphical display.
 
+Some organisations sign in through their own identity provider (for example AD FS
+with Windows sign-in) and do not let Teams renew its sign-in in a headless browser.
+For work/school accounts, login therefore watches the headless browser for up to a
+minute; when Teams is sent back to sign-in, the visible browser is reopened and stays
+open instead. Minimise that window, but keep it open. When a headless session is sent
+back to sign-in later, reads report it; run `desktop login` again.
+
 Use `--desktop-account personal` for a personal Microsoft account. Sending still
 requires an explicit `init --allow-send` and the existing send confirmation.
 `init --no-login` only saves configuration. `desktop connect --visible` remains
@@ -397,7 +429,8 @@ The browser uses its own profile under the local data directory at
 profile. Different ports use different browser profiles. Disconnect closes this
 browser and keeps its sign-in data. To switch between visible and headless operation,
 disconnect first. `desktop recover` closes a verified managed browser or clears a
-stale record when no listener remains. Unverifiable processes are left untouched.
+stale record when no listener remains. A verified browser that does not exit after
+closing its debugging port is stopped; unverifiable processes are left untouched.
 
 The CLI checks that every listener is loopback-only and belongs to the recorded
 browser process, running as you with the expected executable, debugging port and

{teams_cli-0.2.0 → teams_cli-0.2.1}/docs/releases.md

@@ -23,6 +23,45 @@ do not bump again. Its tag starts the release workflow.
 
 Cargo and Python package versions are kept synchronized as one release unit.
 
+## Release 0.2.1
+
+The version is prepared. Do not bump it again. This release adds `people search`
+and `chats create`; opening a conversation does not send a message. Personal
+desktop search separates exact email lookup from name search and excludes
+off-network invitations. A recipient must resolve to a Teams identity before
+chat creation. Graph directory search requires renewed consent to
+`User.ReadBasic.All`.
+
+The Windows helper uses protocol 4 and must match the CLI version and build.
+Validate the Windows helper and WSL client together. Conversation requests and
+sends with an uncertain outcome must never be automatically retried.
+
+Teams Companion 0.1.1 downloads CLI 0.2.1. Publish and verify the CLI archives and
+checksums before distributing the extension so its built-in download works.
+Older stable CLIs from 0.1.11 retain reading and replies; New Message offers an
+update when the required commands are missing. Vership prepares the extension's
+version, while its VSIX package check validates the installable artifact.
+Vership does not publish or verify a VS Code Marketplace target.
+
+Personal-account search, existing-chat reuse and one-shot send/readback passed
+on Windows and WSL; macOS reads and recipient search also passed. First-contact
+creation and work/school New Message runtime coverage remain unverified. Keep
+these limits separate from the earlier work-account read/send reports.
+
+Distinguish existing-chat reuse from first-contact coverage.
+For an approved, discoverable recipient with no existing conversation, resolve
+their exact identity, create the chat once, send one labelled message and verify
+its exact ID and body. A second successful create must return the same chat ID.
+An invite-only search result does not establish a supported recipient and must
+not trigger a message or invitation. Record account/backend/platform limitations
+separately from successful runtime tests.
+
+After approved publication workflows finish, verify every CLI target:
+
+```sh
+vership verify 0.2.1 --targets tag,release,crates,pypi
+```
+
 ## Release 0.2.0
 
 The managed lightweight browser is an experimental personal-account option on

{teams_cli-0.2.0 → teams_cli-0.2.1}/src/auth.rs

@@ -12,9 +12,9 @@ use crate::config::Profile;
 use crate::error::AppError;
 use crate::output::Output;
 
-pub const BASE_SCOPES: &str = "openid profile offline_access User.Read Team.ReadBasic.All Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send ChannelMessage.Send";
+pub const BASE_SCOPES: &str = "openid profile offline_access User.Read User.ReadBasic.All Team.ReadBasic.All Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send ChannelMessage.Send";
 pub const CHANNEL_HISTORY_SCOPE: &str = "ChannelMessage.Read.All";
-pub const CHANNEL_HISTORY_SCOPES: &str = "openid profile offline_access User.Read Team.ReadBasic.All Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send ChannelMessage.Send ChannelMessage.Read.All";
+pub const CHANNEL_HISTORY_SCOPES: &str = "openid profile offline_access User.Read User.ReadBasic.All Team.ReadBasic.All Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send ChannelMessage.Send ChannelMessage.Read.All";
 const SERVICE: &str = "teams-cli";
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -397,6 +397,16 @@ mod tests {
     #[test]
     fn default_login_is_least_privilege() {
         assert!(!BASE_SCOPES.contains(CHANNEL_HISTORY_SCOPE));
+        assert!(
+            BASE_SCOPES
+                .split_whitespace()
+                .any(|scope| scope == "User.ReadBasic.All")
+        );
+        assert!(
+            !BASE_SCOPES
+                .split_whitespace()
+                .any(|scope| scope == "User.Read.All")
+        );
         assert_eq!(scopes(false), BASE_SCOPES);
     }
 

{teams_cli-0.2.0 → teams_cli-0.2.1}/src/backend.rs

@@ -51,6 +51,19 @@ impl TeamsBackend {
             Self::Desktop(client) => client.chats(limit, cursor).await,
         }
     }
+    pub async fn search_people(&self, query: &str, limit: u16) -> Result<Page, AppError> {
+        crate::graph::validate_people_query(query, usize::from(limit))?;
+        match self {
+            Self::Graph(client) => client.search_people(query, usize::from(limit)).await,
+            Self::Desktop(client) => client.search_people(query, limit).await,
+        }
+    }
+    pub async fn create_chat(&self, recipient: &str) -> Result<Value, AppError> {
+        match self {
+            Self::Graph(client) => client.create_chat(recipient).await,
+            Self::Desktop(client) => client.create_chat(recipient).await,
+        }
+    }
     pub async fn messages(
         &self,
         chat: Option<&str>,

{teams_cli-0.2.0 → teams_cli-0.2.1}/src/cli.rs

@@ -66,6 +66,11 @@ pub enum Command {
         #[command(subcommand)]
         command: ChatsCommand,
     },
+    /// Find people to start a conversation with
+    People {
+        #[command(subcommand)]
+        command: PeopleCommand,
+    },
     /// Read and send messages
     Messages {
         #[command(subcommand)]
@@ -187,6 +192,22 @@ pub enum ChannelsCommand {
 #[derive(Debug, Subcommand)]
 pub enum ChatsCommand {
     List(PageArgs),
+    /// Create or reuse a one-to-one conversation; does not send a message
+    Create {
+        /// Exact person ID returned by `people search`
+        #[arg(long)]
+        recipient: String,
+    },
+}
+
+#[derive(Debug, Subcommand)]
+pub enum PeopleCommand {
+    /// Search people by name or email, without sending anything
+    Search {
+        query: String,
+        #[arg(long, default_value_t = 20, value_parser = clap::value_parser!(u16).range(1..=50))]
+        limit: u16,
+    },
 }
 
 #[derive(Debug, Args, Clone)]
@@ -275,6 +296,8 @@ pub enum DesktopCommand {
     Disconnect(DesktopArgs),
     /// Recover interrupted native settings or close a managed browser session
     Recover(DesktopArgs),
+    /// Remove remote-debugging flags from the user-wide WebView2 setting (Windows/WSL)
+    ClearFlags(DesktopArgs),
 }
 
 #[derive(Debug, Args)]