Greptile Summary

This PR migrates the MS Teams channel plugin's HTTP server stub from a reflect-metadata / decorator-metadata hack (~40 lines, reaching into private SDK dist paths) to the public httpServerAdapter option on App(...). The change eliminates a recurring [DEPRECATED] HttpPlugin in plugins array warning and removes fragile code that imported internal decorator paths from @microsoft/teams.apps.

Key changes:

• createNoOpHttpPlugin() (async, reflect-metadata-dependent, ~40 lines) replaced by createNoOpHttpServerAdapter() (3 lines, returns { registerRoute() {} }).
• createMSTeamsApp now passes httpServerAdapter: createNoOpHttpServerAdapter() instead of plugins: [noOpHttp].
• Import added for IHttpServerAdapter — but from @microsoft/teams.apps/dist/http/index.js (a private dist path) rather than the public root export @microsoft/teams.apps, which reintroduces the same dist-fragility concern the PR is otherwise removing.
• One stale JSDoc comment in createMSTeamsAdapter still refers to "the App's HttpPlugin" even though HttpPlugin is no longer used.

Confidence Score: 4/5

Safe to merge; the core logic change is correct and well-motivated, with two small follow-up items that can be fixed in a subsequent commit.

The IHttpServerAdapter implementation satisfies the interface contract (only registerRoute is required; start, stop, serveStatic are optional), tests pass, and the deprecated warning path is correctly removed. The private-dist-path import is a style/fragility concern rather than a runtime bug since it is type-only. The stale JSDoc comment is cosmetic.

extensions/msteams/src/sdk.ts — private dist path on line 1 and stale JSDoc on line 348.

This is a comment left during a code review.
Path: extensions/msteams/src/sdk.ts
Line: 1

Comment:
**Private dist path reintroduced for type import**

The import reaches into `@microsoft/teams.apps/dist/http/index.js` — a private distribution path identical in fragility to the `dist/types/plugin/decorators/*.js` paths the PR is removing. The old code even called this out explicitly: *"FRAGILE: these are internal SDK paths (not public API). If `@microsoft/teams.apps` changes its dist layout, these imports will break."*

`IHttpServerAdapter` is re-exported from the package's public root, so the public subpath should be used instead:

```suggestion
import type { IHttpServerAdapter } from "@microsoft/teams.apps";
```

This keeps the type-safety benefit while importing through the documented public surface and avoids a breaking point on any future SDK dist-layout change.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: extensions/msteams/src/sdk.ts
Line: 348

Comment:
**Stale reference to HttpPlugin in JSDoc**

This JSDoc line still reads *"For incoming requests: the App's HttpPlugin handles JWT validation."*, but `HttpPlugin` is no longer in the picture — the PR replaced it with the `httpServerAdapter` path. The comment should be updated to reflect the new mechanism.

```suggestion
 * For incoming requests: JWT validation is handled by the Teams SDK App's
 * built-in auth middleware (not the now-bypassed HttpPlugin).
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix(msteams): replace deprecated HttpPlu..." | Re-trigger Greptile}

Upstream SDK improvement filed: microsoft/teams.ts#505

This requests the ability to opt out of HTTP server creation entirely in the App constructor (http: false or httpServerAdapter: null), plus properly exporting IHttpServerAdapter from the public barrel.

Until that ships, this PR's no-op httpServerAdapter workaround is the cleanest available option — it uses the SDK's public API (not the deprecated plugins array) and eliminates the recurring deprecation warnings.

Findings

No blocking issues found.

I reviewed the PR diff, checked the surrounding msteams integration paths, and verified the upstream @microsoft/teams.apps@2.0.6 behavior. The switch from the decorator-based fake HttpPlugin to httpServerAdapter looks correct for how OpenClaw actually uses App: token acquisition and proactive messaging, while inbound webhook handling stays in OpenClaw's own Express server.

I also ran the focused Teams SDK test file on the PR branch: extensions/msteams/src/sdk.test.ts, and all 7 tests passed.

Residual risk is low, but there is one non-blocking note: the type-only import from index.js is still coupled to an internal package path. Since it is erased at runtime and the package does not define an exports map, I would not block the PR on it, but it is the main thing I'd keep an eye on in future SDK upgrades.

Merged via squash.

• Prepared head SHA: 7fe7f3c6bb847e1024ecd0e499b3f03588e6d9ec
• Merge commit: 70015be8b585426a974e6f252aefb6a5a618ecf3

Thanks @coolramukaka-sys.