fix(msteams): require admin for group actions by eleqtrizit · Pull Request #91746 · openclaw/openclaw

eleqtrizit · 2026-06-09T18:40:57Z

Summary

Tightens Microsoft Teams group-management message actions so add/remove/rename operations require an owner-authorized requester or an operator.admin gateway caller before Microsoft Graph mutations run.

Changes

Marks addParticipant, removeParticipant, and renameGroup as Teams actions that require a trusted requester sender in Teams tool contexts.
Adds a handler-level authorization gate for those group-management actions before runtime Graph calls are loaded.
Adds regression coverage for trusted-requester declaration, non-owner/non-admin denial, owner success, and operator.admin success.

Validation

corepack pnpm install --frozen-lockfile
corepack pnpm format -- extensions/msteams/src/channel.ts extensions/msteams/src/channel.actions.test.ts
node scripts/run-vitest.mjs extensions/msteams/src/channel.actions.test.ts extensions/msteams/src/channel.test.ts src/channels/plugins/message-actions.security.test.ts
node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.extensions.json extensions/msteams/src/channel.ts extensions/msteams/src/channel.actions.test.ts
git diff --check
.agents/skills/autoreview/scripts/autoreview --mode local clean: no accepted/actionable findings

Notes

No CHANGELOG.md update.
No live Teams Graph call was run; validation uses plugin-level mocked Graph runtime coverage for the authorization boundary.

clawsweeper · 2026-06-09T18:43:23Z

Codex review: needs maintainer review before merge. Reviewed June 9, 2026, 3:17 PM ET / 19:17 UTC.

Summary
The PR adds a Microsoft Teams plugin authorization gate and trusted-requester declaration for addParticipant, removeParticipant, and renameGroup, with regression tests for denial and owner/operator.admin allow paths.

PR surface: Source +27, Tests +167. Total +194 across 2 files.

Reproducibility: yes. from source inspection: current main exposes the three Teams group-management actions and dispatches them to Graph runtime calls without this owner/admin guard. I did not run a live Teams tenant mutation in this read-only review.

Review metrics: 1 noteworthy metric.

Teams group actions gated: 3 changed. addParticipant, removeParticipant, and renameGroup move from callable Graph mutations to owner/operator.admin-only behavior, which is the main compatibility decision before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Maintainer signoff on the fail-closed behavior for shipped Teams group-management actions.

Risk before merge

[P1] Merging intentionally fails closed for three Teams group-management actions, so non-owner/non-admin automations that currently add/remove participants or rename Teams groups will now receive an authorization error before Graph mutation.

Maintainer options:

Accept the fail-closed Teams gate (recommended)
A maintainer can approve landing after acknowledging that non-owner/non-admin add/remove/rename calls now fail before Microsoft Graph is reached.
Pause for a compatibility path
If those group-management automations must remain callable, hold this PR and design an opt-in or migration path instead.

Next step before merge

No automated repair is needed; a maintainer must handle the protected label and accept or reject the fail-closed Teams compatibility change.

Security
Cleared: The diff tightens authorization before Teams Graph mutations and does not add dependency, workflow, credential, or supply-chain risk.

Review details

Best possible solution:

Land the plugin-owned auth gate after a maintainer explicitly accepts the fail-closed behavior for non-owner/non-admin Teams group-management calls.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: current main exposes the three Teams group-management actions and dispatches them to Graph runtime calls without this owner/admin guard. I did not run a live Teams tenant mutation in this read-only review.

Is this the best way to solve the issue?

Yes for code shape: the guard lives in the Teams plugin handler before Graph runtime loading and uses the existing trusted-sender and gateway scope contracts. The remaining issue is maintainer acceptance of the intentional fail-closed compatibility change.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 8b84e951e5a6.

Label changes

Label changes:

add proof: sufficient: Contributor real behavior proof is sufficient. The contributor supplied redacted terminal output from PR head showing the denied non-owner path and owner/operator.admin allow paths at the real Teams action boundary, with only the external Graph mutation boundary stubbed.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The contributor supplied redacted terminal output from PR head showing the denied non-owner path and owner/operator.admin allow paths at the real Teams action boundary, with only the external Graph mutation boundary stubbed.
remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

P1: The PR changes a security-sensitive Microsoft Teams group-management workflow that can mutate membership and group names.
merge-risk: 🚨 compatibility: Existing Teams group-management callers without owner or operator.admin authority will start receiving an authorization error instead of mutating Graph state.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The contributor supplied redacted terminal output from PR head showing the denied non-owner path and owner/operator.admin allow paths at the real Teams action boundary, with only the external Graph mutation boundary stubbed.
proof: sufficient: Contributor real behavior proof is sufficient. The contributor supplied redacted terminal output from PR head showing the denied non-owner path and owner/operator.admin allow paths at the real Teams action boundary, with only the external Graph mutation boundary stubbed.

Evidence reviewed

PR surface:

Source +27, Tests +167. Total +194 across 2 files.

View PR surface stats

Area	Files	Added	Net
Source	1	27	+27
Tests	1	167	+167
Docs	0	0	0
Config	0	0	0
Generated	0	0	0
Other	0	0	0
Total	2	194	+194

What I checked:

PR auth gate: PR head adds MSTEAMS_GROUP_MANAGEMENT_ACTIONS, rejects those actions unless senderIsOwner or operator.admin is present, and runs the check before lazy-loading the Teams runtime. (extensions/msteams/src/channel.ts:92, 07905fde41d1)
Current main behavior: Current main advertises addParticipant, removeParticipant, and renameGroup and dispatches them to Graph runtime calls without an owner/admin auth branch. (extensions/msteams/src/channel.ts:395, 8b84e951e5a6)
Graph mutation surface: The three guarded actions mutate Microsoft Graph membership or chat/channel names, so the changed boundary is security-sensitive. (extensions/msteams/src/graph-group-management.ts:44, 8b84e951e5a6)
Shared trusted-sender contract: The shared dispatcher supports plugin-declared trusted requester requirements and rejects tool-driven calls without requesterSenderId before invoking plugin handlers. (src/channels/plugins/message-action-dispatch.ts:23, 8b84e951e5a6)
Gateway owner/admin contract: Gateway message.action passes requesterSenderId, clamps senderIsOwner for non-admin clients, and passes gatewayClientScopes into channel action dispatch. (src/gateway/server-methods/send.ts:531, 8b84e951e5a6)
PR tests: PR tests cover trusted-requester discovery, non-owner/operator.write denial with no runtime call, owner success, and operator.admin success. (extensions/msteams/src/channel.actions.test.ts:380, 07905fde41d1)

Likely related people:

sudie-codes: Auth-sensitive Teams group-management actions were introduced by the merged group-management PR, whose commits added addParticipant, removeParticipant, renameGroup, and their tests. (role: introduced behavior; confidence: high; commits: f71ee71787c7, e48d52dff900, 197c335f99cf; files: extensions/msteams/src/channel.ts, extensions/msteams/src/graph-group-management.ts, extensions/msteams/src/channel.actions.test.ts)
BradGroux: The group-management PR discussion shows BradGroux reviewed the Teams Graph changes, and follow-up commits restored plugin contracts and guardrails around that surface. (role: reviewer and adjacent fixer; confidence: medium; commits: 256ac029dcc8, 278a2061ad6b, 776075e3c142; files: extensions/msteams/src/channel.ts, extensions/msteams/src/graph-group-management.ts)
steipete: A later merged Teams security-hardening PR touched graph-group-management role validation, OData escaping, attachment fetch hardening, and setup OAuth launch behavior. (role: recent security hardening contributor; confidence: medium; commits: c56b56e514f8; files: extensions/msteams/src/graph-group-management.ts, extensions/msteams/src/setup-surface.ts, extensions/msteams/src/attachments/shared.ts)
vincentkoc: Current-main blame on the Teams action exposure and Graph mutation paths points to a broad carry-forward commit by Vincent Koc, so this is a useful current-code routing signal even though older PR history is richer. (role: current-main carry-forward contributor; confidence: medium; commits: b08e1109c67e; files: extensions/msteams/src/channel.ts, extensions/msteams/src/graph-group-management.ts, src/channels/plugins/message-action-dispatch.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

eleqtrizit · 2026-06-09T19:06:37Z

Real behavior proof

Behavior addressed: Microsoft Teams addParticipant, removeParticipant, and renameGroup message actions now fail closed unless the request is owner-authorized or the Gateway caller has operator.admin; Teams tool contexts also declare that these group-management actions require a trusted requester sender.
Real environment tested: local OpenClaw checkout on PR head 07905fde41d1ef6281de8e4a440f1378d1a352ad, Node 22.22.2, loading the real extensions/msteams/src/channel.ts source through node --import tsx. The proof intercepted only the dynamic ./channel.runtime.js Microsoft Graph boundary so no real tenant membership/name mutation was performed.
Exact steps or command run after this patch: node --import tsx /tmp/msteams-proof.Y7Oq57.mjs
Evidence after fix:

trusted-requester gate addParticipant/msteams: true
non-owner operator.write denied: {"isError":true,"content":[{"type":"text","text":"Microsoft Teams group management requires an owner or operator.admin requester."}],"details":{"error":"Microsoft Teams group management requires an owner or operator.admin requester."}}
Graph addParticipant calls after denial: 0
owner addParticipant allowed: {"content":[{"type":"text","text":"{\"ok\":true,\"channel\":\"msteams\",\"action\":\"addParticipant\",\"added\":{\"chatId\":\"conversation:19:redacted@thread.tacv2\",\"userId\":\"redacted-user\"}}"}],"details":{"ok":true,"channel":"msteams","action":"addParticipant","added":{"chatId":"conversation:19:redacted@thread.tacv2","userId":"redacted-user"}}}
Graph addParticipant calls after owner path: 1
operator.admin removeParticipant allowed: {"content":[{"type":"text","text":"{\"ok\":true,\"channel\":\"msteams\",\"action\":\"removeParticipant\",\"removed\":{\"chatId\":\"conversation:19:redacted@thread.tacv2\",\"userId\":\"redacted-user\"}}"}],"details":{"ok":true,"channel":"msteams","action":"removeParticipant","removed":{"chatId":"conversation:19:redacted@thread.tacv2","userId":"redacted-user"}}}
Graph removeParticipant calls after admin path: 1
operator.admin renameGroup allowed: {"content":[{"type":"text","text":"{\"ok\":true,\"channel\":\"msteams\",\"action\":\"renameGroup\",\"renamed\":{\"chatId\":\"conversation:19:redacted@thread.tacv2\",\"newName\":\"Redacted group\"}}"}],"details":{"ok":true,"channel":"msteams","action":"renameGroup","renamed":{"chatId":"conversation:19:redacted@thread.tacv2","newName":"Redacted group"}}}
Graph renameGroup calls after admin path: 1

Observed result after fix: a non-owner operator.write request returns the new authorization error and does not call the Graph mutation boundary. Owner-authorized addParticipant succeeds and reaches the Graph boundary once. operator.admin removeParticipant and renameGroup succeed and each reach the Graph boundary once.
What was not tested: no live Microsoft Teams tenant / Microsoft Graph mutation was executed because this environment has no Teams credentials and we should not mutate a real tenant for proof. The external Graph boundary was stubbed; the plugin authorization and action-return behavior used the real PR source.
Proof limitations or environment constraints: this is redacted local runtime proof, not a live Graph proof. It covers the ClawSweeper-requested denied non-owner path plus owner and operator.admin success paths at the OpenClaw Teams action boundary.
Before evidence: current main had the same three actions wired directly to Graph runtime calls without the owner/admin gate; this PR adds MSTEAMS_GROUP_MANAGEMENT_ACTIONS, requiresTrustedRequesterSender, and requireMSTeamsGroupManagementAuthorization before the calls at extensions/msteams/src/channel.ts.

Compatibility/security-boundary decision: I accept the intentional fail-closed behavior for these three shipped Teams group-management actions. Existing non-owner/non-admin automations that add, remove, or rename Teams groups should now receive the authorization error instead of mutating Teams state; owner-authorized and operator.admin workflows remain allowed.

@clawsweeper re-review

clawsweeper · 2026-06-09T19:06:41Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27229358437
Updated: 2026-06-09T19:18:09.977Z

eleqtrizit · 2026-06-09T19:47:42Z

Summary of Checks

Relevance

Multiple independent assessments confirmed the vulnerability is in scope: the Teams plugin's group-management actions (addParticipant, removeParticipant, renameGroup) execute Microsoft Graph mutations without authorization checks, while the Discord plugin already has an equivalent guard. The issue is unfixed on current main and the latest shipped release.

Compatibility

The fix follows the established Discord plugin pattern using the existing requiresTrustedRequesterSender hook and senderIsOwner/gatewayClientScopes context fields — no new core permission model, config keys, env vars, protocol messages, or dependency changes were introduced. Authorized owner/admin workflows continue to work. The only newly rejected behavior is the vulnerable lower-scope path, which is the intended security boundary.

ClawSweeper

ClawSweeper initially blocked the PR requiring real behavior proof and maintainer acceptance of the fail-closed compatibility change. Both requirements were satisfied: redacted real runtime proof was posted showing non-owner denial and authorized owner/admin success paths, and the fail-closed impact was explicitly accepted.

Code Reviews Completed

The implementation was reviewed against code quality standards: proper use of existing plugin SDK hooks, defense-in-depth with both dispatcher-level and handler-level checks, clean plugin boundary compliance, clear error messages, early-return patterns, and comprehensive regression tests covering trusted-requester declaration, non-owner/non-admin denial, owner success, and operator.admin success.

Proof

Behavioral proof: A redacted local runtime proof demonstrated that non-owner operator.write callers are denied with the correct error and make zero Graph calls, while owner and operator.admin callers succeed and reach the Graph boundary.
Test proof: All 48 tests across the Teams action tests, channel tests, and message-actions security tests pass.
CI proof: CI is passing — the only failed shard was an unrelated gateway startup/restart test that never ran its test command (infrastructure setup failure, not related to the Teams changes).

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

fix(msteams): require admin for group actions

07905fd

openclaw-barnacle Bot added channel: msteams Channel integration: msteams size: S maintainer Maintainer-authored PR labels Jun 9, 2026

eleqtrizit merged commit d2ddc26 into openclaw:main Jun 9, 2026
227 of 238 checks passed

github-actions Bot mentioned this pull request Jun 9, 2026

📡 Upstream Digest — 2026-06-09 19:57 UTC curtismercier/openclaw-mods#1047

Open

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 10, 2026

fix(msteams): require admin for group actions (openclaw#91746)

4c9c0ed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(msteams): require admin for group actions#91746

fix(msteams): require admin for group actions#91746
eleqtrizit merged 1 commit into
openclaw:mainfrom
eleqtrizit:729

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

eleqtrizit commented Jun 9, 2026

Summary

Changes

Validation

Notes

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 9, 2026

Real behavior proof

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 9, 2026

Summary of Checks

Relevance

Compatibility

ClawSweeper

Code Reviews Completed

Proof

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading