test(e2e): cover Microsoft Teams in the channels stop/start matrix

[hunglp6d]

Summary

Add Microsoft Teams to the channels-stop-start live E2E matrix for OpenClaw and Hermes.
The test now covers existing Microsoft Teams onboarding, configuration rendering, provider creation, network policy, and channel lifecycle behavior.

Related Issue

Related: #5585

Changes

• Add teams to the channels-stop-start matrix for both agent runtimes.
• Add test inputs for the {sandbox}-teams-bridge provider, fake MSTEAMS_* and TEAMS_* environment-variable values, and Microsoft Teams plan assertions.
• Map the OpenClaw test key from teams to msteams so the test reads channels.msteams.
• Assert that the Hermes .env file contains TEAMS_CLIENT_SECRET=openshell:resolve:env:MSTEAMS_APP_PASSWORD.
• Limit the change to the E2E test harness. It does not change production code, a schema, the CLI, configuration behavior, or a supported surface.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This change expands live E2E coverage for existing behavior. docs/manage-sandboxes/set-up-microsoft-teams.mdx already documents Microsoft Teams for OpenClaw and Hermes, including the environment variables exercised by this test. No command, flag, configuration behavior, or supported surface changes.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: No documentation paths changed. The PR adds Microsoft Teams to the live channels-stop-start E2E matrix and does not change a command, configuration, default, or supported behavior. docs/manage-sandboxes/set-up-microsoft-teams.mdx already documents Microsoft Teams for OpenClaw and Hermes, including the credentials, access controls, webhook port, and mention mode exercised by this test.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
  Not applicable. scripts/prepare-dgx-station-host.sh is not changed.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result: npm run typecheck:cli (exit 0); npx @biomejs/biome check (no findings); npx vitest run --project e2e-support (168 files and 1,794 tests passing). The live channels-stop-start E2E target runs through GitHub CI on Brev and is not available in the local contributor environment.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Hung Le hple@nvidia.com

Summary by CodeRabbit

• Tests
  • Added Microsoft Teams to live channel stop/start coverage for OpenClaw and Hermes.
  • Added assertions for Microsoft Teams credentials and runtime configuration.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

The live channels stop/start test replaces WhatsApp coverage with Teams coverage, adds Teams credentials and runtime environment variables, and validates Teams-specific channel inputs, OpenClaw mapping, and Hermes configuration.

Changes

Teams channel integration

Layer / File(s)	Summary
Teams provider and environment setup test/e2e/live/channels-stop-start-helpers.ts	The exercised channel list, provider factory, token structure, token generation, and Teams environment variables are updated for Teams.
Teams configuration validation test/e2e/live/channels-stop-start-helpers.ts	Assertions validate Teams inputs, map Teams to msteams, and check Hermes resolves TEAMS_CLIENT_SECRET.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: aasthajh, afourniernv, ahunnargikar-nvidia, aknvda, amata-human

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the added Microsoft Teams coverage in the channels stop/start E2E test matrix.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/msteams-e2e-channels-stop-start

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit a8ac241 in the test/msteams-e2e-cha... branch remains at 96%, unchanged from commit 4cd4d64 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit a8ac241 in the test/msteams-e2e-cha... branch remains at 81%, unchanged from commit a931be4 in the main branch.

Show a code coverage summary of the most impacted files.

File	main a931be4	test/msteams-e2e-cha... a8ac241	+/-
src/lib/policy/...ne-exclusion.ts	97%	92%	-5%
src/lib/private-networks.ts	93%	90%	-3%
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/tunnel/services.ts	76%	76%	0%
src/lib/credentials/store.ts	55%	56%	+1%

---

_{Updated August 03, 2026 10:47 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

2 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• rebuild-openclaw: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• rebuild-hermes: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — Teams at test/e2e/live/channels-stop-start-helpers.ts:38: Keep Teams as the short product name in this comment.
• replace — agent arm at test/e2e/live/channels-stop-start-helpers.ts:38: Replace “both agent arms” with “both agent runtimes.”

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture, channels-stop-start

2 optional E2E recommendations

• messaging-providers
• network-policy

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/live/channels-stop-start-helpers.ts`:
- Around line 230-234: Extend the Teams assertion block in the helper to
validate every configuration input supplied by phase6TokenEnv(), including
allowedUsers mapped from TEAMS_ALLOWED_USERS and webhookPort mapped from
MSTEAMS_PORT, while preserving the existing appId, tenantId, and requireMention
assertions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2b5f8e2d-efa4-49e1-be2f-d501ec1535ff

📥 Commits

Reviewing files that changed from the base of the PR and between da1b103 and d498670.

📒 Files selected for processing (1)

• test/e2e/live/channels-stop-start-helpers.ts

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[cv]

Security review for commit a8ac241bba75ddbb6369a7be969b818a1383f27b — PASS

Scope is established by merged PR #5585, which introduced the supported Microsoft Teams channel. This pull request changes only the existing live E2E lifecycle matrix; it does not add a product surface.

1. Secrets and credentials — PASS. Credential values come from the environment or unmistakably fake test defaults. The Teams secret is included in the existing command-artifact redaction set, and the config probe emits only yes or no.
2. Input validation and data sanitization — PASS. The added channel identifiers and shell probes are fixed test constants. Environment-derived expected values are not interpolated into shell commands, and production manifest validation remains the authority exercised by the test.
3. Authentication and authorization — PASS. No authentication or authorization behavior changes. The test verifies the existing Teams credential binding, provider, rendered configuration, and lifecycle state.
4. Dependencies and third-party libraries — PASS. No dependency, package, image, or download changes.
5. Error handling and logging — PASS. Command artifacts retain the existing credential redaction path. The new assertions do not compare or print the Teams secret.
6. Cryptography and data protection — PASS. No cryptographic behavior changes. The Hermes probe checks the existing secret-store placeholder rather than reading or printing secret material.
7. Configuration and security headers — PASS. No production configuration changes. The test requires the existing Teams network-policy preset and channel-scoped policy entry.
8. Security testing — PASS. The live matrix now exercises Teams onboarding, policy, provider, rendered configuration, stop, and restart behavior for both supported agent paths.
9. System security — PASS. The change uses the existing sandbox-name guard, provider cleanup helpers, and command wrappers. It adds no privilege, host-process, filesystem, or network-policy bypass.

No security findings. Required GitHub checks for this commit remain authoritative; no local test suite was run for this review.