fix(messaging): install botbuilder SDK for hermes Teams channel

[TonyLuo-NV]

Summary

The Hermes Teams channel never installed its runtime SDK in the sandbox. The manifest declared microsoft-teams-apps==2.0.13.4 (the new fastapi/uvicorn-based Teams AI SDK), but the Hermes Teams adapter and its network policy target the Bot Framework Connector, i.e. the aiohttp-based Bot Framework SDK (botbuilder-core / botbuilder-integration-aiohttp). Those packages were therefore never installed, so the Teams bridge failed at runtime (#5952).

Related Issue

Fixes #5952

Changes

• src/lib/messaging/channels/teams/manifest.ts: replace the Hermes microsoft-teams-apps==2.0.13.4 package with botbuilder-core==4.17.1 and botbuilder-integration-aiohttp==4.17.1. aiohttp==3.14.1 is kept and satisfies the integration package's aiohttp<4.0,>=3.10 constraint.
• Updated manifest/compiler/applier tests that pinned the old spec (manifests.test.ts, metadata.test.ts, manifest-compiler.test.ts, messaging-build-applier.test.ts).

Why these packages

The Hermes Teams network policy (agents/hermes/policy-additions.yaml) allows login.botframework.com, api.botframework.com, and smba.trafficmanager.net (Bot Connector), and the code comment states "The SDK follows Bot Connector serviceUrl values from inbound Teams activities." This is the Bot Framework SDK, not the new Teams AI SDK. The original feature commit (#5585) introduced both the Bot Framework policy hosts and the wrong package in one change.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: internal package-install manifest fix; no user-facing doc surface changes (Teams onboarding behavior unchanged, only the installed SDK is corrected).
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: messaging path. Packages are pinned to exact versions of the official Microsoft Bot Framework SDK on PyPI; they enter the existing Hermes uv-pip trusted-package allowlist (validated by trustedHermesUvPackageSpecsForPlan), and the required egress hosts were already allowed by the Teams policy preset. Requesting maintainer sensitive-path review.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes
• Targeted tests pass for changed behavior — 62 tests: 41 in the three cli-project messaging tests + 21 in test/messaging-build-applier.test.ts (incl. the Hermes Teams install test and the trusted-package allowlist test).
• Full npm test passes (broad runtime changes only)
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Tony Luo xialuo@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Updated Microsoft Teams support for the Hermes agent to install the correct BotBuilder dependencies.
  • Improved package installation expectations so Teams-related builds now use the latest pinned dependency versions.
  • Kept the rest of the messaging channel setup and build flow unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d91bd3b7-5b3a-4898-8794-13b0695ae1b1

📥 Commits

Reviewing files that changed from the base of the PR and between 09bef70 and 89e2eda.

📒 Files selected for processing (5)

• src/lib/messaging/channels/manifests.test.ts
• src/lib/messaging/channels/metadata.test.ts
• src/lib/messaging/channels/teams/manifest.ts
• src/lib/messaging/compiler/manifest-compiler.test.ts
• test/messaging-build-applier.test.ts

---

📝 Walkthrough

Walkthrough

Replaces the microsoft-teams-apps==2.0.13.4 pip dependency for the Hermes agent's Teams channel with two pinned packages: botbuilder-core==4.17.1 and botbuilder-integration-aiohttp==4.17.1. The change is made in the Teams manifest source and reflected across four test files.

Hermes Teams dependency replacement

Layer / File(s)	Summary
Teams manifest and test updates src/lib/messaging/channels/teams/manifest.ts, src/lib/messaging/channels/manifests.test.ts, src/lib/messaging/channels/metadata.test.ts, src/lib/messaging/compiler/manifest-compiler.test.ts, test/messaging-build-applier.test.ts	agentPackages for hermes drops microsoft-teams-apps==2.0.13.4 and adds botbuilder-core==4.17.1 and botbuilder-integration-aiohttp==4.17.1; all test assertions for manifest contents, install specs, build plan steps, and pip install commands are updated accordingly.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: installing BotBuilder SDK packages for the Hermes Teams channel.
Linked Issues check	✅ Passed	The manifest now installs botbuilder-core and botbuilder-integration-aiohttp for Hermes Teams, matching the linked issue's required fix.
Out of Scope Changes check	✅ Passed	The changes are confined to Hermes Teams messaging manifest updates and related tests, with no clear unrelated scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[cv]

Blocking correctness review on exact head 89e2eda:

This replacement does not match the runtime source pinned by current main.

• agents/hermes/Dockerfile.base pins Hermes v2026.6.19.
• In that exact tarball, plugins/platforms/teams/adapter.py imports microsoft_teams.apps.App, microsoft_teams.api, microsoft_teams.cards, and related microsoft_teams.* modules. Its module header says pip install microsoft-teams-apps aiohttp.
• The adapter sets TEAMS_SDK_AVAILABLE = false when those imports fail, and check_requirements() returns TEAMS_SDK_AVAILABLE && AIOHTTP_AVAILABLE.
• The pinned adapter contains no botbuilder import. Bot Connector destinations in the network policy describe the service protocol/hosts; they do not establish that the adapter uses the BotBuilder Python package namespace.

Therefore removing microsoft-teams-apps==2.0.13.4 and installing only BotBuilder packages makes the current pinned Teams adapter unavailable at runtime. The linked issue reports Hermes v0.14.0, while current main pins a newer dated release, so its package expectation must be revalidated against the current runtime before changing the manifest.

Required before merge:

1. Preserve microsoft-teams-apps for the current adapter unless the pinned Hermes source is changed to a BotBuilder-based implementation.
2. If a distinct current runtime path truly imports BotBuilder, identify that exact file/import and add the packages in addition to—not instead of—the SDK required by plugins/platforms/teams/adapter.py.
3. Add a compiled/image-level regression that installs the manifest plan and imports the actual pinned Teams adapter (or asserts check_requirements() succeeds), rather than only asserting the generated pip argv.
4. Re-run the relevant Hermes Teams build/start E2E on the corrected head.

Do not merge this head: it turns the current Teams SDK import into a guaranteed missing dependency.

[TonyLuo-NV]

@cv You're right — thank you for the careful review. I verified against the pinned runtime and this change is incorrect.

What I checked (pinned Hermes v2026.6.19, the exact tag + SHA in agents/hermes/Dockerfile.base, HERMES_TARBALL_SHA256 verified):

• pyproject.toml teams extra: ["microsoft-teams-apps==2.0.13.4", "aiohttp==3.13.4"] — no botbuilder.
• plugins/platforms/teams/adapter.py imports microsoft_teams.apps, microsoft_teams.api, microsoft_teams.cards, microsoft_teams.common; sets TEAMS_SDK_AVAILABLE only if those resolve; check_requirements() = TEAMS_SDK_AVAILABLE and AIOHTTP_AVAILABLE. Zero botbuilder imports in the entire tarball.
• microsoft-teams-apps==2.0.13.4 transitively provides every microsoft_teams.* submodule the adapter uses (microsoft-teams-api → microsoft-teams-cards + microsoft-teams-common), so the existing single dependency is sufficient.

My root cause was wrong: I inferred BotBuilder from the Bot Connector hosts in the network policy, but those are the service endpoints the microsoft-teams-apps SDK talks to, not evidence of the BotBuilder Python package. Swapping the package would force TEAMS_SDK_AVAILABLE=False and break the Teams adapter, exactly as you noted.

The existing manifest (microsoft-teams-apps==2.0.13.4) is already correct for the pinned adapter, so there is no change to make here. Closing this PR as invalid. The linked issue was filed against Hermes v0.14.0; current main pins v2026.6.19 (SDK-based), so I'll note on #5952 that it needs re-validation against the current runtime.