feat(messaging): onboard Microsoft Teams channel - #5585
Merged
Conversation
Signed-off-by: San Dang <sdang@nvidia.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds Microsoft Teams as a fully supported messaging channel across NemoClaw: Teams channel manifest with inputs, credentials, render fragments for OpenClaw and Hermes, and lifecycle hooks; host-forward planning engine integrated into the compiler and workflow planner; network policy preset with Microsoft/Azure endpoint allowlists; Hermes uv-pip package installer for Teams Python dependencies; port-conflict detection hooks with overlap status reporting; onboarding orchestration with port preservation and rollback; process recovery for webhook forwards; and comprehensive test coverage across compiler, manifests, policies, and integration scenarios. ChangesMicrosoft Teams Messaging Channel Rollout
Sequence Diagram(s)sequenceDiagram
participant ManifestCompiler
participant planHostForward
participant MessagingWorkflowPlanner
participant refreshDerivedPlanFields
ManifestCompiler->>planHostForward: compileChannel(manifest, inputs, active, resolver)
planHostForward-->>ManifestCompiler: SandboxMessagingHostForwardPlan | undefined
ManifestCompiler-->>MessagingWorkflowPlanner: SandboxMessagingChannelPlan with hostForward
MessagingWorkflowPlanner->>refreshDerivedPlanFields: stop/start/rebuild plan update
refreshDerivedPlanFields->>planHostForward: recompute hostForward per channel
planHostForward-->>refreshDerivedPlanFields: updated SandboxMessagingHostForwardPlan
refreshDerivedPlanFields-->>MessagingWorkflowPlanner: updated plan with hostForward and runtimeSetup
sequenceDiagram
participant ensureDashboardForward
participant resolveMessagingHostForwardForSandbox
participant ensureMessagingHostForwardForSandbox
participant ensureForward
participant abortMessagingHostForwardFailure
ensureDashboardForward->>resolveMessagingHostForwardForSandbox: resolve active hostForward
resolveMessagingHostForwardForSandbox-->>ensureDashboardForward: port to preserve
ensureDashboardForward->>ensureDashboardForward: add port to preservedPorts
ensureDashboardForward->>ensureMessagingHostForwardForSandbox: ensure webhook forward
ensureMessagingHostForwardForSandbox->>ensureForward: start forward(sandboxName, port, label)
ensureForward-->>ensureMessagingHostForwardForSandbox: true / false
alt forward fails with rollback enabled
ensureMessagingHostForwardForSandbox->>abortMessagingHostForwardFailure: stop ports, delete sandbox
abortMessagingHostForwardFailure-->>abortMessagingHostForwardFailure: exit(1)
end
Estimated code review effort🎯 5 (Critical) | ⏱️ ~120 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-5585.docs.buildwithfern.com/nemoclaw |
2 tasks
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 7 items to resolve/justify, 0 in-scope improvements
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (2)
nemoclaw-blueprint/policies/tiers.yaml (1)
47-47: 🧹 Nitpick | 🔵 TrivialRun
network-policy-e2efor the Open-tier preset expansion.Adding
teamsto the default Open tier broadens policy scope; please run the targeted network-policy job to validate deny-by-default, whitelist behavior, hot-reload, and SSRF filtering with the new preset mix.As per coding guidelines: changes under
nemoclaw-blueprint/policies/**should runnetwork-policy-e2e.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@nemoclaw-blueprint/policies/tiers.yaml` at line 47, You have modified the network policies in the tiers.yaml file by adding teams with read-write access to the Open tier. Per coding guidelines, any changes to nemoclaw-blueprint/policies/** require running the network-policy-e2e test suite to validate that the policy expansion maintains deny-by-default behavior, whitelist functionality, hot-reload capabilities, and SSRF filtering. Run the network-policy-e2e job to verify these behaviors work correctly with the new teams access added to the Open tier preset.Source: Coding guidelines
agents/hermes/policy-additions.yaml (1)
258-340: 🧹 Nitpick | 🔵 TrivialRun the Hermes E2E set for this channel-policy addition.
This change touches Hermes channel onboarding/egress behavior, so run the Hermes-targeted nightly jobs before merge to catch policy + lifecycle regressions (
hermes-e2e,hermes-inference-switch-e2e,hermes-discord-e2e,hermes-slack-e2e,hermes-onboard-security-posture-e2e,rebuild-hermes-e2e,rebuild-hermes-stale-base-e2e).As per coding guidelines: changes under
agents/hermes/**should be validated with the listed Hermes E2E jobs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/hermes/policy-additions.yaml` around lines 258 - 340, Before merging this Teams channel policy addition (which modifies the teams endpoint configuration with various Microsoft hosts including login.microsoftonline.com, api.botframework.com, graph.microsoft.com, and others with request_body_credential_rewrite settings), you must run the Hermes E2E test suite to validate that the policy changes do not introduce regressions. Execute all of the following Hermes-targeted E2E test jobs: hermes-e2e, hermes-inference-switch-e2e, hermes-discord-e2e, hermes-slack-e2e, hermes-onboard-security-posture-e2e, rebuild-hermes-e2e, and rebuild-hermes-stale-base-e2e to ensure no policy or lifecycle issues are introduced by these changes under agents/hermes/policy-additions.yaml.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/_components/StarterPromptButton.tsx`:
- Around line 149-153: The shell code block in StarterPromptButton.tsx uses a
generic `shell` fence instead of a language-specific one and hardcodes
`nemoclaw` commands instead of using the alias-agnostic placeholder. Change the
code fence from `shell` to `bash` to make it copyable, and replace all
occurrences of the `nemoclaw` command with `$$nemoclaw` in both the channels add
teams command and the rebuild command to ensure the example works for both
OpenClaw and Hermes environments.
In `@docs/about/overview.mdx`:
- Line 41: The table row for "Messaging channels" in the overview table contains
multiple sentences combined into a single line, which violates the markdown
guideline of one sentence per line. Locate the Messaging channels table cell and
split the content into separate lines, placing each distinct sentence on its own
line while maintaining the table's markdown structure. The cell currently has at
least two sentences about OpenShell-managed processes and NemoClaw configuration
that should each be on their own lines.
In `@src/lib/messaging/applier/build/messaging-build-applier.mts`:
- Around line 892-893: The regex pattern used to validate package specs does not
adequately prevent leading dashes, allowing malicious options like -r or
--index-url to bypass validation and be interpreted as CLI options by uv pip
install. Fix this by modifying the regex pattern to include a negative lookahead
that explicitly rejects any spec starting with a dash, and add the -- delimiter
before the selectedPackages variable when constructing the uv pip install
command to ensure all following arguments are treated as requirement specs
rather than CLI options.
In `@src/lib/onboard/messaging-host-forward.ts`:
- Around line 35-38: The normalizedPlan assignment currently falls back to the
unparsed plan value when parseSandboxMessagingPlan fails, bypassing parser
validation. Remove the ?? plan fallback from the normalizedPlan assignment so
that when parseSandboxMessagingPlan returns null or undefined, normalizedPlan
becomes null instead of reverting to the original unparsed plan, ensuring
invalid data is not passed to hydrateDerivedSandboxMessagingPlanFields.
In `@test/policies-teams.test.ts`:
- Around line 19-24: The requirePresetContent function has an if statement
checking the null condition that is causing the test-conditionals:scan CI check
to fail. Remove the if statement that tests !content and the throw statement
inside it, then use a non-null assertion operator on the return statement
instead to assert that content is truthy. Keep the expect assertion at the
beginning to maintain the test validation.
---
Nitpick comments:
In `@agents/hermes/policy-additions.yaml`:
- Around line 258-340: Before merging this Teams channel policy addition (which
modifies the teams endpoint configuration with various Microsoft hosts including
login.microsoftonline.com, api.botframework.com, graph.microsoft.com, and others
with request_body_credential_rewrite settings), you must run the Hermes E2E test
suite to validate that the policy changes do not introduce regressions. Execute
all of the following Hermes-targeted E2E test jobs: hermes-e2e,
hermes-inference-switch-e2e, hermes-discord-e2e, hermes-slack-e2e,
hermes-onboard-security-posture-e2e, rebuild-hermes-e2e, and
rebuild-hermes-stale-base-e2e to ensure no policy or lifecycle issues are
introduced by these changes under agents/hermes/policy-additions.yaml.
In `@nemoclaw-blueprint/policies/tiers.yaml`:
- Line 47: You have modified the network policies in the tiers.yaml file by
adding teams with read-write access to the Open tier. Per coding guidelines, any
changes to nemoclaw-blueprint/policies/** require running the network-policy-e2e
test suite to validate that the policy expansion maintains deny-by-default
behavior, whitelist functionality, hot-reload capabilities, and SSRF filtering.
Run the network-policy-e2e job to verify these behaviors work correctly with the
new teams access added to the Open tier preset.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: af41e3bd-1aaa-4379-930c-8a19bf19304e
📒 Files selected for processing (76)
agents/hermes/Dockerfileagents/hermes/Dockerfile.baseagents/hermes/manifest.yamlagents/hermes/policy-additions.yamlagents/openclaw/manifest.yamldocs/_components/StarterPromptButton.tsxdocs/about/overview.mdxdocs/deployment/brev-web-ui.mdxdocs/deployment/deploy-to-remote-gpu.mdxdocs/get-started/quickstart.mdxdocs/manage-sandboxes/lifecycle.mdxdocs/manage-sandboxes/messaging-channels.mdxdocs/manage-sandboxes/runtime-controls.mdxdocs/network-policy/customize-network-policy.mdxdocs/network-policy/integration-policy-examples.mdxdocs/reference/architecture.mdxdocs/reference/commands-nemohermes.mdxdocs/reference/commands.mdxdocs/reference/network-policies.mdxdocs/reference/troubleshooting.mdxdocs/security/best-practices.mdxnemoclaw-blueprint/policies/presets/teams.yamlnemoclaw-blueprint/policies/tiers.yamlsrc/lib/actions/sandbox/channel-status.test.tssrc/lib/actions/sandbox/policy-channel-conflict.test.tssrc/lib/actions/sandbox/policy-channel.tssrc/lib/actions/sandbox/process-recovery.tssrc/lib/actions/sandbox/rebuild.tssrc/lib/agent/defs.test.tssrc/lib/inventory/index.test.tssrc/lib/inventory/index.tssrc/lib/messaging-channel-config.test.tssrc/lib/messaging/AGENTS.mdsrc/lib/messaging/applier/build/messaging-build-applier.mtssrc/lib/messaging/applier/setup-applier.tssrc/lib/messaging/channels/built-ins.tssrc/lib/messaging/channels/manifests.test.tssrc/lib/messaging/channels/metadata.test.tssrc/lib/messaging/channels/slack/manifest.tssrc/lib/messaging/channels/teams/hooks/host-forward-port-conflict.test.tssrc/lib/messaging/channels/teams/hooks/host-forward-port-conflict.tssrc/lib/messaging/channels/teams/hooks/index.tssrc/lib/messaging/channels/teams/manifest.tssrc/lib/messaging/channels/teams/template-resolver.tssrc/lib/messaging/channels/template-resolver.tssrc/lib/messaging/compiler/engines/host-forward-engine.tssrc/lib/messaging/compiler/manifest-compiler.test.tssrc/lib/messaging/compiler/manifest-compiler.tssrc/lib/messaging/compiler/workflow-planner.test.tssrc/lib/messaging/compiler/workflow-planner.tssrc/lib/messaging/diagnostics.test.tssrc/lib/messaging/hooks/builtins.tssrc/lib/messaging/hooks/common/config-prompt.tssrc/lib/messaging/hooks/hook-runner.test.tssrc/lib/messaging/host-forward.tssrc/lib/messaging/index.tssrc/lib/messaging/manifest/types.tssrc/lib/messaging/persistence.tssrc/lib/messaging/plan-validation.test.tssrc/lib/messaging/plan-validation.tssrc/lib/onboard/agent-dashboard-forward.test.tssrc/lib/onboard/agent-dashboard-forward.tssrc/lib/onboard/dashboard.tssrc/lib/onboard/initial-policy.test.tssrc/lib/onboard/messaging-host-forward.test.tssrc/lib/onboard/messaging-host-forward.tssrc/lib/onboard/messaging-prep.test.tssrc/lib/sandbox/channels.test.tssrc/lib/status-command-deps.tssrc/lib/tunnel/services.tstest/channels-add-preset.test.tstest/messaging-build-applier.test.tstest/messaging-plan-test-helper.tstest/policies-teams.test.tstest/policies.test.tstest/sandbox-provider-cleanup.test.ts
💤 Files with no reviewable changes (2)
- src/lib/messaging/channels/slack/manifest.ts
- src/lib/messaging/hooks/common/config-prompt.ts
sandl99
added
area: messaging
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 27931132475
|
cv
approved these changes
Jun 22, 2026
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/actions/sandbox/process-recovery.ts`:
- Around line 268-271: The fallback logic in parseSandboxCommandResult that uses
the nullish coalescing operator (??), executeLocalDockerSandboxCommand pattern
does not distinguish between a genuine parse failure and a case where OpenShell
already executed the command but stdout framing/marker parsing failed. This
causes non-idempotent commands to execute twice. Modify the logic to check
whether the command was actually executed in OpenShell (even if parsing failed)
before falling back to executeLocalDockerSandboxCommand. You may need to return
additional information from parseSandboxCommandResult or check the result object
directly to determine if OpenShell executed the command, and only fall back to
Docker if execution did not occur at all.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 04f358a6-508a-4ff0-a07e-e57eeddc9da4
📒 Files selected for processing (2)
src/lib/actions/sandbox/process-recovery.tstest/process-recovery.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- test/process-recovery.test.ts
Contributor
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/actions/sandbox/process-recovery.ts`:
- Around line 268-271: The fallback logic in parseSandboxCommandResult that uses
the nullish coalescing operator (??), executeLocalDockerSandboxCommand pattern
does not distinguish between a genuine parse failure and a case where OpenShell
already executed the command but stdout framing/marker parsing failed. This
causes non-idempotent commands to execute twice. Modify the logic to check
whether the command was actually executed in OpenShell (even if parsing failed)
before falling back to executeLocalDockerSandboxCommand. You may need to return
additional information from parseSandboxCommandResult or check the result object
directly to determine if OpenShell executed the command, and only fall back to
Docker if execution did not occur at all.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 04f358a6-508a-4ff0-a07e-e57eeddc9da4
📒 Files selected for processing (2)
src/lib/actions/sandbox/process-recovery.tstest/process-recovery.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- test/process-recovery.test.ts
🛑 Comments failed to post (1)
src/lib/actions/sandbox/process-recovery.ts (1)
268-271: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Prevent duplicate command execution on parse-only failure.
At Line 268, Docker fallback runs whenever parsing returns
null. Thatnullalso includes cases where OpenShell already executed the command but stdout framing/marker parsing failed, so the same command can be executed twice (OpenShell + Docker fallback). For non-idempotent commands this can duplicate side effects.⚙️ Proposed fix
- return ( - parseSandboxCommandResult(result) ?? - executeLocalDockerSandboxCommand(sandboxName, markedCommand, effectiveTimeout) - ); + const parsed = parseSandboxCommandResult(result); + if (parsed) return parsed; + if (result.error || (result.status ?? 1) !== 0) { + return executeLocalDockerSandboxCommand(sandboxName, markedCommand, effectiveTimeout); + } + return null;📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.const parsed = parseSandboxCommandResult(result); if (parsed) return parsed; if (result.error || (result.status ?? 1) !== 0) { return executeLocalDockerSandboxCommand(sandboxName, markedCommand, effectiveTimeout); } return null;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/actions/sandbox/process-recovery.ts` around lines 268 - 271, The fallback logic in parseSandboxCommandResult that uses the nullish coalescing operator (??), executeLocalDockerSandboxCommand pattern does not distinguish between a genuine parse failure and a case where OpenShell already executed the command but stdout framing/marker parsing failed. This causes non-idempotent commands to execute twice. Modify the logic to check whether the command was actually executed in OpenShell (even if parsing failed) before falling back to executeLocalDockerSandboxCommand. You may need to return additional information from parseSandboxCommandResult or check the result object directly to determine if OpenShell executed the command, and only fall back to Docker if execution did not occur at all.
…ng-onboard # Conflicts: # src/lib/actions/sandbox/process-recovery.ts # src/lib/onboard/agent-dashboard-forward.ts
… into feat/ms-teams-messaging-onboard
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 28003939444
|
14 tasks
14 tasks
5 tasks
21 tasks
cv
pushed a commit
that referenced
this pull request
Jun 25, 2026
<!-- markdownlint-disable MD041 --> ## Summary Refreshes the v0.0.68 docs with release notes, Microsoft Teams messaging guidance, and generated support-matrix coverage. Also corrects the Hermes generated command reference so `sessions export` examples match Hermes-only behavior while keeping the shared command heading compatible with CLI parity checks. ## Changes - #5585 -> `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/platform-support.mdx`: Documents experimental Microsoft Teams channel setup, Bot Framework credentials, webhook forwarding, local `MSTEAMS_PORT` conflicts, and the generated integration support row. - #5526 -> `docs/reference/commands.mdx`, `docs/reference/commands-nemohermes.mdx`: Keeps Hermes `sessions export` examples on the supported single-JSONL export path while preserving the canonical shared CLI heading. - #5044 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for installer onboarding failure propagation. - #5641 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for fresh recovery after pre-sandbox installer interruption. - #5673 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for explicit deny-all messaging manifests. - #5743 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for unsupported-agent channel-add rejection. - #5252 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for Hermes `gateway-token` dashboard guidance. - #5659 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for local OpenClaw `agent` wrapper help. - #5661 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for default extra-agent paths. - #5669 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for Deep Agents Code branding. - #5672 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for hosted-compatible default model ID preservation. - #5725 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for Deep Agents Code sandbox liveness. - #5644 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for DGX Spark managed-vLLM express install defaults. - #5712 -> `docs/about/release-notes.mdx`, `docs/reference/platform-support.mdx`: Adds v0.0.68 release-note coverage for the canonical support matrix and updates the matrix source with Teams. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: docs-only release refresh; no runtime code changed. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — `npm run docs` passed with 0 errors; Fern reported the existing light-mode accent contrast warning. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Additional verification: - `python3 scripts/generate-platform-docs.py --check` passed. - `npm run docs:sync-agent-variants` passed. - `bash test/e2e/e2e-cloud-experimental/check-docs.sh --only-cli` passed. - `npm run docs` passed with 0 errors and one Fern theme warning: light-mode accent contrast ratio is 2.41:1 and should be at least 3:1. - `npm run build:cli` refreshed local untracked `dist/` artifacts after rebase; no tracked files changed. - `npm run typecheck:cli` passed. - Normal commit and push hooks passed after the local CLI rebuild. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Miyoung Choi <miyoungc@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added **Microsoft Teams** as an experimental messaging channel, including manifest-first onboarding, local port routing/conflict handling, sandbox delivery controls, and policy preset support. * **Documentation** * Expanded messaging-channel setup for Teams (prerequisites, credential/webhook setup, wizard flow, and add/remove commands). * Updated reference docs for **agent-specific** session export examples (OpenClaw vs Hermes). * Refreshed platform support guidance and added the latest release-notes entry. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
21 tasks
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Adds experimental Microsoft Teams channel onboarding through NemoClaw's manifest-first messaging architecture for OpenClaw and Hermes. The change wires Teams credentials, policy presets, package installs, config rendering, host webhook forwarding, recovery handling, and tests so Teams participates in onboard, rebuild, and channel lifecycle flows. ### Key features 1. Adding MS Teams channel 2. Support Port forwarding for messaging channel generic. (support for callback, bi-directional call, e.g. Chat host calls into OpenClaw/Hermes) ### Inputs MSTEAMS_APP_ID: ClientID - Required MSTEAMS_APP_PASSWORD: ClientSecret - Required MSTEAMS_TENANT_ID: TenantId - Required MSTEAMS_ALLOWED_USERS: Optional - OpenClaw allows to pairing after setup. ## Related Issue Part of NVIDIA#5492 ## Result <img width="1988" height="576" alt="image" src="https://github.com/user-attachments/assets/d3fd0033-dfdb-4a3a-b4a8-88e75af22061" /> ## Changes - Add a built-in Microsoft Teams messaging manifest, template resolver, host-forward conflict/status hooks, and manifest registration. - Add manifest-declared host-forward planning, validation, persistence, dashboard preservation, and process-recovery support for webhook ports such as `MSTEAMS_PORT`. - Add Teams network policy presets plus OpenClaw and Hermes package/config integration. - Treat the Teams user allowlist as optional, pin Hermes Teams PyPI packages, narrow Graph egress to read-only GET, and fail closed on malformed persisted host-forward plans. - Update messaging metadata, inventory/status surfaces, and channel commands for Teams setup and lifecycle behavior. - Add focused tests for Teams manifests, hooks, policy presets, build applier behavior, host forwarding, rebuild hydration, process recovery, and channel lifecycle handling. - Leave user-facing documentation to a follow-up docs-owner change. ## PR Review Advisor justification PR Review Advisor follow-up: NVIDIA#5585 (comment) - `PRA-1`: `TEAMS_ALLOWED_USERS` is intentionally **optional**. Microsoft app, tenant, and Bot Framework auth are the primary boundary; allowed_list can be added later via openclaw. - `PRA-2`: The plan-tampering risk is addressed by exact pins plus the trusted built-in manifest recheck. Hash/lockfile verification is broader supply-chain hardening and can be tracked separately. - `PRA-3`: Addressed in `8ab7b004f`: Graph is now read-only in both Teams policy sources, and the remaining Bot Connector wildcard is documented and tested as method-scoped because SDK service URLs vary by tenant/region. - `PRA-4`: Deferred for now. Teams IDs come from Microsoft tooling and are validated downstream; adding strict manifest regexes risks rejecting legitimate forms before we have stronger runtime evidence. No additional mocked tests added for the justified items; real Teams E2E needs an external Microsoft tenant/app. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Tests added or updated for new or changed behavior - [x] No secrets, API keys, or credentials committed - [ ] Docs updated for user-facing behavior changes - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification run: - `npm run build:cli` - `npx vitest run src/lib/onboard/messaging-host-forward.test.ts src/lib/messaging/channels/manifests.test.ts src/lib/messaging/channels/metadata.test.ts src/lib/messaging/compiler/manifest-compiler.test.ts src/lib/messaging/compiler/workflow-planner.test.ts test/messaging-build-applier.test.ts test/policies-teams.test.ts test/process-recovery.test.ts` - `npx vitest run test/sandbox-connect-inference/auto-pair-approval.test.ts` - `npm run typecheck:cli` - `npm run test-conditionals:scan -- --top 25` - Normal commit hooks passed, including the broad CLI hook - Pushes after hook-verified commits used `git push --no-verify` as requested --- Signed-off-by: San Dang <sdang@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary of Changes **New Features** - Added **Microsoft Teams** as a supported messaging platform for both **OpenClaw** and **Hermes**, including Teams channel setup (credentials, allowed users, webhook port, mention mode). - Introduced a **Teams network policy preset** to enable required Microsoft/Teams endpoints. - Implemented **Teams webhook host-forwarding** with **conflict detection** and **overlap/status reporting**. **Improvements** - Preserves messaging host-forward ports during dashboard refresh and restores them during sandbox recovery. - Messaging overlap warnings now include the **conflicted port**. - Rebuild and channel enable/disable flows now correctly recompute Teams host-forwarding. - Updated prompt behavior to no longer surface manifest placeholders. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: San Dang <sdang@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Refreshes the v0.0.68 docs with release notes, Microsoft Teams messaging guidance, and generated support-matrix coverage. Also corrects the Hermes generated command reference so `sessions export` examples match Hermes-only behavior while keeping the shared command heading compatible with CLI parity checks. ## Changes - NVIDIA#5585 -> `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/platform-support.mdx`: Documents experimental Microsoft Teams channel setup, Bot Framework credentials, webhook forwarding, local `MSTEAMS_PORT` conflicts, and the generated integration support row. - NVIDIA#5526 -> `docs/reference/commands.mdx`, `docs/reference/commands-nemohermes.mdx`: Keeps Hermes `sessions export` examples on the supported single-JSONL export path while preserving the canonical shared CLI heading. - NVIDIA#5044 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for installer onboarding failure propagation. - NVIDIA#5641 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for fresh recovery after pre-sandbox installer interruption. - NVIDIA#5673 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for explicit deny-all messaging manifests. - NVIDIA#5743 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for unsupported-agent channel-add rejection. - NVIDIA#5252 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for Hermes `gateway-token` dashboard guidance. - NVIDIA#5659 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for local OpenClaw `agent` wrapper help. - NVIDIA#5661 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for default extra-agent paths. - NVIDIA#5669 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for Deep Agents Code branding. - NVIDIA#5672 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for hosted-compatible default model ID preservation. - NVIDIA#5725 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for Deep Agents Code sandbox liveness. - NVIDIA#5644 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for DGX Spark managed-vLLM express install defaults. - NVIDIA#5712 -> `docs/about/release-notes.mdx`, `docs/reference/platform-support.mdx`: Adds v0.0.68 release-note coverage for the canonical support matrix and updates the matrix source with Teams. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: docs-only release refresh; no runtime code changed. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — `npm run docs` passed with 0 errors; Fern reported the existing light-mode accent contrast warning. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Additional verification: - `python3 scripts/generate-platform-docs.py --check` passed. - `npm run docs:sync-agent-variants` passed. - `bash test/e2e/e2e-cloud-experimental/check-docs.sh --only-cli` passed. - `npm run docs` passed with 0 errors and one Fern theme warning: light-mode accent contrast ratio is 2.41:1 and should be at least 3:1. - `npm run build:cli` refreshed local untracked `dist/` artifacts after rebase; no tracked files changed. - `npm run typecheck:cli` passed. - Normal commit and push hooks passed after the local CLI rebuild. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Miyoung Choi <miyoungc@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added **Microsoft Teams** as an experimental messaging channel, including manifest-first onboarding, local port routing/conflict handling, sandbox delivery controls, and policy preset support. * **Documentation** * Expanded messaging-channel setup for Teams (prerequisites, credential/webhook setup, wizard flow, and add/remove commands). * Updated reference docs for **agent-specific** session export examples (OpenClaw vs Hermes). * Refreshed platform support guidance and added the latest release-notes entry. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
23 tasks
prekshivyas
pushed a commit
that referenced
this pull request
Aug 3, 2026
…7875) <!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 plain sentences: what changes and why. Describe before-and-after behavior when it applies. Follow the NemoClaw Writing Guide: https://github.com/NVIDIA/NemoClaw/blob/main/WRITING.md. Do not add unrelated prose cleanup. --> Add Microsoft Teams to the `channels-stop-start` live E2E matrix for OpenClaw and Hermes. The test now covers existing Microsoft Teams onboarding, configuration rendering, provider creation, network policy, and channel lifecycle behavior. ## Related Issue <!-- Fixes #NNN or Closes #NNN. Remove this section if none. --> Related: #5585 ## Changes <!-- List concrete changes. If this adds an abstraction, configuration, fallback, migration, or compatibility path, name its current requirement and consumer, explain why a direct change is insufficient, and identify the test that protects it. --> - Add `teams` to the `channels-stop-start` matrix for both agent runtimes. - Add test inputs for the `{sandbox}-teams-bridge` provider, fake `MSTEAMS_*` and `TEAMS_*` environment-variable values, and Microsoft Teams plan assertions. - Map the OpenClaw test key from `teams` to `msteams` so the test reads `channels.msteams`. - Assert that the Hermes `.env` file contains `TEAMS_CLIENT_SECRET=openshell:resolve:env:MSTEAMS_APP_PASSWORD`. - Limit the change to the E2E test harness. It does not change production code, a schema, the CLI, configuration behavior, or a supported surface. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: This change expands live E2E coverage for existing behavior. `docs/manage-sandboxes/set-up-microsoft-teams.mdx` already documents Microsoft Teams for OpenClaw and Hermes, including the environment variables exercised by this test. No command, flag, configuration behavior, or supported surface changes. - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review <!-- Required for code and documentation changes after the changes and applicable validation are complete. Keep one review checkbox and one instance of each visible or hidden field. For Evidence, list changed documentation paths. For documentation-only changes, also state that the writing rules and documentation style were reviewed. For other results, explain why no documentation change is needed or why the review is blocked. For Agent, use a consistent product and surface name, such as Codex Desktop, Codex CLI, Claude Code, or Cursor. After committing all review changes, put `git rev-parse --short HEAD` and `git rev-parse --short HEAD:AGENTS.md` in the hidden metadata below. Rerun the review and refresh that metadata after any new commit. This receipt is advisory during the data-collection pilot. --> - [x] Documentation writer subagent reviewed the completed changes - Result: `no-docs-needed` - Evidence: No documentation paths changed. The PR adds Microsoft Teams to the live `channels-stop-start` E2E matrix and does not change a command, configuration, default, or supported behavior. `docs/manage-sandboxes/set-up-microsoft-teams.mdx` already documents Microsoft Teams for OpenClaw and Hermes, including the credentials, access controls, webhook port, and mention mode exercised by this test. - Agent: Codex Desktop <!-- docs-review-head-sha: a8ac241 --> <!-- docs-review-agents-blob-sha: 3dd7c24 --> ## DGX Station Hardware Evidence <!-- Required only when scripts/prepare-dgx-station-host.sh changes. Maintainers must review the linked evidence before approving or merging. This is human-reviewed evidence, not authenticated hardware provenance. Exceptional bypasses use existing repository governance and must be documented on the PR. --> - [ ] Tested on DGX Station Not applicable. `scripts/prepare-dgx-station-host.sh` is not changed. ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result: `npm run typecheck:cli` (exit 0); `npx @biomejs/biome check` (no findings); `npx vitest run --project e2e-support` (168 files and 1,794 tests passing). The live `channels-stop-start` E2E target runs through GitHub CI on Brev and is not available in the local contributor environment. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Hung Le <hple@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added Microsoft Teams to live channel stop/start coverage for OpenClaw and Hermes. * Added assertions for Microsoft Teams credentials and runtime configuration. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Hung Le <hple@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: San Dang <sdang@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
20 tasks
prekshivyas
pushed a commit
that referenced
this pull request
Aug 18, 2026
## Summary The Policy Tiers table in `docs/reference/network-policies.mdx` did not list the `teams` preset in its Open row, while the `open` tier in `nemoclaw-blueprint/policies/tiers.yaml` has applied that preset since commit `17d03317b` (#5585). An operator who read this table before selecting Open was not told that the tier opens Microsoft Teams egress by default. The Open row now names `teams` in the position it occupies in `tiers.yaml`, with the experimental tag that `docs/reference/platform-support.mdx` records for the channel. ## Related Issue Fixes #9503 This repeats a correction the project already accepted. Issue #3688 reported the identical drift for `wechat`, and PR #4276 (commit `a5768a244`) corrected the same row the same way. PR #5585 added `teams` to the `open` tier and stated that it would "Leave user-facing documentation to a follow-up docs-owner change"; that follow-up did not reach this page. ## Changes - `docs/reference/network-policies.mdx`: add `` `teams` (experimental) `` to the Open row of the Policy Tiers table, between `whatsapp` and `jira`, matching the preset order in `nemoclaw-blueprint/policies/tiers.yaml`. One existing table row changed. Net line delta is ±0 (1 insertion, 1 deletion, one file). No new abstraction, configuration, fallback, migration, or compatibility path. Checked and unchanged: the Restricted, Balanced, and Personal rows already match `tiers.yaml`, so `teams` is the table's only omission. Not changed, and offered here instead: the `<AgentOnly variant="openclaw">` note earlier on the same page says "The baseline policy does not include messaging endpoints for Telegram, Discord, Slack, WeChat, or WhatsApp." That sentence omits Microsoft Teams and also Google Chat. Google Chat is not a tier preset, so that sentence belongs to a different premise than this tier-table drift, and adding only Teams would leave a new partial list. Say the word and I will extend that note in this PR or a separate one. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: the change is one documentation table cell and alters no executable behavior. `npm run docs` is the validation for this page. If you want a guard against the next recurrence, the natural home is the existing tier-loader test surface for `src/lib/policy/tiers.ts`: one case that reads `resolveTierPresets("open")` and asserts each preset name appears in the Open row of `docs/reference/network-policies.mdx`. That adds lines, so I left it out of this ±0 change and will add it in this PR if you prefer it here. - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: Updated docs/reference/network-policies.mdx. The writing rules and documentation style were reviewed. - Agent: Pi CLI <!-- docs-review-head-sha: 0473cf7 --> <!-- docs-review-agents-blob-sha: 993bdd8 --> ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable — `npm run validate:pr` passed after refreshing `origin/main` and rebasing onto the current `main` - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — marked not applicable above; `npm run docs` exits 0 - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [x] `npm run docs` builds without warnings (doc changes only) — 0 errors. The two reported warnings are the unauthenticated Fern redirects check and the site accent-color contrast ratio; both appear identically on an unmodified checkout of this page. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Udaya Tejas <udayatejas2004@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated network policy reference documentation to include the experimental `teams` preset in the Open policy tier. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Udaya Tejas <udayatejas2004@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds experimental Microsoft Teams channel onboarding through NemoClaw's manifest-first messaging architecture for OpenClaw and Hermes. The change wires Teams credentials, policy presets, package installs, config rendering, host webhook forwarding, recovery handling, and tests so Teams participates in onboard, rebuild, and channel lifecycle flows.
Key features
Inputs
MSTEAMS_APP_ID: ClientID - Required
MSTEAMS_APP_PASSWORD: ClientSecret - Required
MSTEAMS_TENANT_ID: TenantId - Required
MSTEAMS_ALLOWED_USERS: Optional - OpenClaw allows to pairing after setup.
Related Issue
Part of #5492
Result
Changes
MSTEAMS_PORT.PR Review Advisor justification
PR Review Advisor follow-up: #5585 (comment)
PRA-1:TEAMS_ALLOWED_USERSis intentionally optional. Microsoft app, tenant, and Bot Framework auth are the primary boundary; allowed_list can be added later via openclaw.PRA-2: The plan-tampering risk is addressed by exact pins plus the trusted built-in manifest recheck. Hash/lockfile verification is broader supply-chain hardening and can be tracked separately.PRA-3: Addressed in8ab7b004f: Graph is now read-only in both Teams policy sources, and the remaining Bot Connector wildcard is documented and tested as method-scoped because SDK service URLs vary by tenant/region.PRA-4: Deferred for now. Teams IDs come from Microsoft tooling and are validated downstream; adding strict manifest regexes risks rejecting legitimate forms before we have stronger runtime evidence.No additional mocked tests added for the justified items; real Teams E2E needs an external Microsoft tenant/app.
Type of Change
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Verification run:
npm run build:clinpx vitest run src/lib/onboard/messaging-host-forward.test.ts src/lib/messaging/channels/manifests.test.ts src/lib/messaging/channels/metadata.test.ts src/lib/messaging/compiler/manifest-compiler.test.ts src/lib/messaging/compiler/workflow-planner.test.ts test/messaging-build-applier.test.ts test/policies-teams.test.ts test/process-recovery.test.tsnpx vitest run test/sandbox-connect-inference/auto-pair-approval.test.tsnpm run typecheck:clinpm run test-conditionals:scan -- --top 25git push --no-verifyas requestedSigned-off-by: San Dang sdang@nvidia.com
Summary by CodeRabbit
Summary of Changes
New Features
Improvements