Claude-coauthored Teams reply code copied unfiltered thread history into the model context, letting blocked senders influence channel replies.

+  resolveTeamGroupId,+} from "../graph-thread.js"; import {   extractMSTeamsConversationMessageId,   extractMSTeamsQuoteInfo,@@ -474,6 +480,29 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {     });      const mediaPayload = buildMSTeamsMediaPayload(mediaList);++    // Fetch thread history when the message is a reply inside a Teams channel thread.+    // This is a best-effort enhancement; errors are logged and do not block the reply.+    let threadContext: string | undefined;+    if (activity.replyToId && isChannel && teamId) {+      try {+        const graphToken = await tokenProvider.getAccessToken("https://graph.microsoft.com");+        const groupId = await resolveTeamGroupId(graphToken, teamId);+        const [parentMsg, replies] = await Promise.all([+          fetchChannelMessage(graphToken, groupId, conversationId, activity.replyToId),+          fetchThreadReplies(graphToken, groupId, conversationId, activity.replyToId),+        ]);+        const allMessages = parentMsg ? [parentMsg, ...replies] : replies;+        const formatted = formatThreadContext(allMessages, activity.id);+        if (formatted) {+          threadContext = formatted;+        }+      } catch (err) {+        log.debug?.("failed to fetch thread history", { error: String(err) });+        // Graceful degradation: thread history is an optional enhancement.+      }+    }+     const envelopeFrom = isDirectMessage ? senderName : conversationType;     const { storePath, envelopeOptions, previousTimestamp } = resolveInboundSessionEnvelopeContext({       cfg,@@ -518,9 +547,14 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {         : undefined;     const commandBody = text.trim(); +    // Prepend thread history to the agent body so the agent has full thread context.+    const bodyForAgent = threadContext+      ? `[Thread history]\n${threadContext}\n[/Thread history]\n\n${rawBody}`+      : rawBody;+     const ctxPayload = core.channel.reply.finalizeInboundContext({       Body: combinedBody,-      BodyForAgent: rawBody,+      BodyForAgent: bodyForAgent,       InboundHistory: inboundHistory,       RawBody: rawBody,       CommandBody: commandBody,

+    application?: { displayName?: string; id?: string };+  };+  body?: { content?: string; contentType?: string };+  createdDateTime?: string;+};

+ * Teams wraps mentions in <at>Name</at> tags.+ */+export function stripHtmlFromTeamsMessage(html: string): string {+  // Preserve mention display names by replacing <at>Name</at> with @Name.+  let text = html.replace(/<at[^>]*>(.*?)<\/at>/gi, "@$1");+  // Strip remaining HTML tags.+  text = text.replace(/<[^>]*>/g, " ");+  // Decode common HTML entities.+  text = text+    .replace(/&amp;/g, "&")+    .replace(/&lt;/g, "<")+    .replace(/&gt;/g, ">")+    .replace(/&quot;/g, '"')+    .replace(/&#39;/g, "'")+    .replace(/&nbsp;/g, " ");+  // Normalize whitespace.+  return text.replace(/\s+/g, " ").trim();+}++/**+ * Resolve the Azure AD group GUID for a Teams conversation team ID.+ * Results are cached with a TTL to avoid repeated Graph API calls.+ */+export async function resolveTeamGroupId(+  token: string,+  conversationTeamId: string,+): Promise<string> {+  const cached = teamGroupIdCache.get(conversationTeamId);+  if (cached && cached.expiresAt > Date.now()) {+    return cached.groupId;+  }++  // The team ID in channelData is typically the group ID itself for standard teams.+  // Validate by fetching /teams/{id} and returning the confirmed id.+  // Requires Team.ReadBasic.All permission; fall back to raw ID if missing.+  try {+    const path = `/teams/${encodeURIComponent(conversationTeamId)}?$select=id`;+    const team = await fetchGraphJson<{ id?: string }>({ token, path });+    const groupId = team.id ?? conversationTeamId;++    // Only cache when the Graph lookup succeeds — caching a fallback raw ID+    // can cause silent failures for the entire TTL if the ID is not a valid

+  } catch {+    // Fallback to raw team ID without caching so subsequent calls retry the+    // Graph lookup instead of using a potentially invalid cached value.+    return conversationTeamId;+  }+}++/**+ * Fetch a single channel message (the parent/root of a thread).+ * Returns undefined on error so callers can degrade gracefully.+ */+export async function fetchChannelMessage(+  token: string,

+  fetchThreadReplies,+  formatThreadContext,+  resolveTeamGroupId,+  stripHtmlFromTeamsMessage,+} from "./graph-thread.js";+import { fetchGraphJson } from "./graph.js";++vi.mock("./graph.js", () => ({+  fetchGraphJson: vi.fn(),+}));++describe("stripHtmlFromTeamsMessage", () => {+  it("preserves @mention display names from <at> tags", () => {+    expect(stripHtmlFromTeamsMessage("<at>Alice</at> hello")).toBe("@Alice hello");+  });++  it("strips other HTML tags", () => {+    expect(stripHtmlFromTeamsMessage("<p>Hello <b>world</b></p>")).toBe("Hello world");+  });++  it("decodes common HTML entities", () => {+    expect(stripHtmlFromTeamsMessage("&amp; &lt;b&gt; &quot;x&quot; &#39;y&#39; &nbsp;z")).toBe(+      "& <b> \"x\" 'y' z",+    );+  });++  it("normalizes multiple whitespace to single space", () => {+    expect(stripHtmlFromTeamsMessage("hello   world")).toBe("hello world");+  });++  it("handles <at> tags with attributes", () => {+    expect(stripHtmlFromTeamsMessage('<at id="123">Bob</at> please review')).toBe(+      "@Bob please review",+    );+  });++  it("returns empty string for empty input", () => {+    expect(stripHtmlFromTeamsMessage("")).toBe("");+  });+});++describe("resolveTeamGroupId", () => {+  beforeEach(() => {+    vi.mocked(fetchGraphJson).mockReset();+    _teamGroupIdCacheForTest.clear();+  });++  it("fetches team id from Graph and caches it", async () => {+    vi.mocked(fetchGraphJson).mockResolvedValueOnce({ id: "group-guid-1" } as never);++    const result = await resolveTeamGroupId("tok", "team-123");+    expect(result).toBe("group-guid-1");+    expect(fetchGraphJson).toHaveBeenCalledWith({+      token: "tok",+      path: "/teams/team-123?$select=id",+    });+  });++  it("returns cached value without calling Graph again", async () => {+    vi.mocked(fetchGraphJson).mockResolvedValueOnce({ id: "group-guid-2" } as never);++    await resolveTeamGroupId("tok", "team-456");+    await resolveTeamGroupId("tok", "team-456");++    expect(fetchGraphJson).toHaveBeenCalledTimes(1);+  });++  it("falls back to conversationTeamId when Graph returns no id", async () => {+    vi.mocked(fetchGraphJson).mockResolvedValueOnce({} as never);++    const result = await resolveTeamGroupId("tok", "team-fallback");+    expect(result).toBe("team-fallback");+  });+});++describe("fetchChannelMessage", () => {+  beforeEach(() => {+    vi.mocked(fetchGraphJson).mockReset();+  });++  it("fetches the parent message with correct path", async () => {+    const mockMsg = { id: "msg-1", body: { content: "hello", contentType: "text" } };+    vi.mocked(fetchGraphJson).mockResolvedValueOnce(mockMsg as never);++    const result = await fetchChannelMessage("tok", "group-1", "channel-1", "msg-1");

-        const formatted = formatThreadContext(allMessages, activity.id);

+                  allowNameMatching,+                }).allowed;+              })+            : allMessages;+        const formatted = formatThreadContext(threadMessages, activity.id);         if (formatted) {           threadContext = formatted;         }

+  })),+}));++const graphThreadMockState = vi.hoisted(() => ({+  resolveTeamGroupId: vi.fn(async () => "group-1"),+  fetchChannelMessage: vi.fn<+    (+      token: string,

+      token: string,+      groupId: string,

+vi.mock("../../runtime-api.js", async () => {+  const actual =

+vi.mock("../graph-thread.js", async () => {+  const actual = await vi.importActual<typeof import("../graph-thread.js")>("../graph-thread.js");+  return {+    ...actual,+    resolveTeamGroupId: graphThreadMockState.resolveTeamGroupId,+    fetchChannelMessage: graphThreadMockState.fetchChannelMessage,+    fetchThreadReplies: graphThreadMockState.fetchThreadReplies,+  };+});++vi.mock("../reply-dispatcher.js", () => ({+  createMSTeamsReplyDispatcher: () => ({+    dispatcher: {},+    replyOptions: {},+    markDispatchIdle: vi.fn(),+  }),+}));+ describe("msteams monitor handler authz", () => {   function createDeps(cfg: OpenClawConfig) {     const readAllowFromStore = vi.fn(async () => ["attacker-aad"]);     const upsertPairingRequest = vi.fn(async () => null);+    const recordInboundSession = vi.fn(async () => undefined);     setMSTeamsRuntime({       logging: { shouldLogVerbose: () => false },+      system: { enqueueSystemEvent: vi.fn() },       channel: {         debounce: {           resolveInboundDebounceMs: () => 0,@@ -28,6 +88,20 @@ describe("msteams monitor handler authz", () => {         text: {           hasControlCommand: () => false,         },+        routing: {+          resolveAgentRoute: ({ peer }: { peer: { kind: string; id: string } }) => ({+            sessionKey: `msteams:${peer.kind}:${peer.id}`,+            agentId: "default",+            accountId: "default",+          }),+        },+        reply: {+          formatAgentEnvelope: ({ body }: { body: string }) => body,+          finalizeInboundContext: <T extends Record<string, unknown>>(ctx: T) => ctx,