feat(teams): outbound files (FileConsent + SharePoint) + inbound Graph fallback

gateway/platforms/base.py

@@ -1996,6 +1996,14 @@ def extract_images(content: str) -> Tuple[List[Tuple[str, str]], str]:
         - <img src="https://example.com/image.png">
         - <img src="https://example.com/image.png"></img>
 
+        Both the markdown and HTML branches require the URL to either end in a
+        known image extension (.png/.jpg/.jpeg/.gif/.webp) or contain a known
+        image-CDN host fragment. Without that guard, the bot can boomerang any
+        ``<img>`` tag it merely *quotes* in prose (e.g. an inbound Teams AMS
+        URL or a teaching-example placeholder like ``<img src="https://...">``)
+        as a real outbound attachment, which the destination platform can't
+        authenticate and renders as a broken-image icon.
+
         Args:
             content: The response text to scan.
 
@@ -2005,21 +2013,38 @@ def extract_images(content: str) -> Tuple[List[Tuple[str, str]], str]:
         images = []
         cleaned = content
 
+        def _looks_like_image_url(url: str) -> bool:
+            """Allowlist check shared by markdown and HTML branches.
+
+            A URL is treated as an image only if it has a recognized image
+            extension in its path (matched before any query string) or its
+            host/path contains a known image-CDN fragment.
+            """
+            lower = url.lower().split("?", 1)[0].split("#", 1)[0]
+            image_exts = (".png", ".jpg", ".jpeg", ".gif", ".webp")
+            if lower.endswith(image_exts):
+                return True
+            cdn_fragments = ("fal.media", "fal-cdn", "replicate.delivery")
+            url_lower = url.lower()
+            return any(fragment in url_lower for fragment in cdn_fragments)
+
         # Match markdown images: ![alt](url)
         md_pattern = r'!\[([^\]]*)\]\((https?://[^\s\)]+)\)'
         for match in re.finditer(md_pattern, content):
             alt_text = match.group(1)
             url = match.group(2)
             # Only extract URLs that look like actual images
-            if any(url.lower().endswith(ext) or ext in url.lower() for ext in
-                   ['.png', '.jpg', '.jpeg', '.gif', '.webp', 'fal.media', 'fal-cdn', 'replicate.delivery']):
+            if _looks_like_image_url(url):
                 images.append((url, alt_text))
 
         # Match HTML img tags: <img src="url"> or <img src="url"></img> or <img src="url"/>
         html_pattern = r'<img\s+src=["\']?(https?://[^\s"\'<>]+)["\']?\s*/?>\s*(?:</img>)?'
         for match in re.finditer(html_pattern, content):
             url = match.group(1)
-            images.append((url, ""))
+            # Apply the same allowlist as the markdown branch so we don't peel
+            # quoted/example <img> tags and ship them as broken attachments.
+            if _looks_like_image_url(url):
+                images.append((url, ""))
 
         # Remove only the matched image tags from content (not all markdown images)
         if images:

gateway/run.py

@@ -1963,6 +1963,14 @@ async def _handle_adapter_fatal_error(self, adapter: BasePlatformAdapter) -> Non
                 await adapter.disconnect()
             finally:
                 self.adapters.pop(adapter.platform, None)
+                # Drop from the running-adapter registry too so a stale
+                # closed instance isn't left pointing at a dead
+                # connection. See tools/_running_adapters.py.
+                try:
+                    from tools._running_adapters import clear_running_adapter
+                    clear_running_adapter(adapter.platform.value)
+                except Exception:  # pragma: no cover
+                    logger.exception("Failed to clear %s from running-adapter registry", adapter.platform.value)
                 self.delivery_router.adapters = self.adapters
 
         # Queue retryable failures for background reconnection
@@ -3521,6 +3529,20 @@ async def start(self) -> bool:
                 success = await self._connect_adapter_with_timeout(adapter, platform)
                 if success:
                     self.adapters[platform] = adapter
+                    # Publish to the module-level running-adapter registry
+                    # so outbound code paths in webhook-receive platforms
+                    # (Teams Bot Framework, future Webex/Zoom/Google Chat)
+                    # can reach the *live* instance — not a fresh one.
+                    # Stateless REST adapters don't strictly need this but
+                    # registering them anyway keeps the API uniform and
+                    # opens the door to "send via running adapter" patterns
+                    # for any future use case. See
+                    # tools/_running_adapters.py for the rationale.
+                    try:
+                        from tools._running_adapters import set_running_adapter
+                        set_running_adapter(platform.value, adapter)
+                    except Exception:  # pragma: no cover — registry must never block connect
+                        logger.exception("Failed to publish %s to running-adapter registry", platform.value)
                     self._sync_voice_mode_state_to_adapter(adapter)
                     connected_count += 1
                     self._update_platform_runtime_status(
@@ -4793,6 +4815,14 @@ async def _platform_reconnect_watcher(self) -> None:
                     success = await self._connect_adapter_with_timeout(adapter, platform)
                     if success:
                         self.adapters[platform] = adapter
+                        # Mirror the connect-time registry publish so the
+                        # reconnect path keeps the running-adapter registry
+                        # in sync. See tools/_running_adapters.py.
+                        try:
+                            from tools._running_adapters import set_running_adapter
+                            set_running_adapter(platform.value, adapter)
+                        except Exception:  # pragma: no cover
+                            logger.exception("Failed to publish %s to running-adapter registry", platform.value)
                         self._sync_voice_mode_state_to_adapter(adapter)
                         self.delivery_router.adapters = self.adapters
                         del self._failed_platforms[platform]