PR #70287: fix(msteams): drop unsupported $search on msteams:search (AI-assisted)

• Repository: openclaw/openclaw
• Author: gaurav0107
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/70287

Description (problem / solution / changelog)

Summary

• Problem: msteams:search action hits HTTP 400: Search is not supported because Graph API blocks $search on /chats/{id}/messages and /teams/*/channels/*/messages when called with Application permissions (the default for bot auth).
• Why it matters: The action is unusable for any bot running on app-only credentials — which is the most common msteams deployment.
• What changed: Replace $search with a list-and-local-filter path that works under Application permissions. Sender filtering still pushes down via $filter (which Graph supports app-only). Local filter strips HTML bodies so queries match rendered text.
• What did NOT change (scope boundary): Delegated-auth code paths, other msteams actions, Graph token resolution, or /search/query callers elsewhere in the repo. Search range is now bounded to the recent list window rather than the full archive — full-archive search requires Delegated auth and is out of scope for this fix.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #70127
• This PR fixes a bug or regression

Root Cause

• Root cause: The original implementation of searchMessagesMSTeams used $search in the Graph query string. Graph API documentation is explicit that $search on message collections is not available for Application permissions — only /search/query with Delegated auth supports it for chat messages, and even that blocks the chatMessage entity for app-only.
• Missing detection / guardrail: No integration test hit a Graph-like 400 for $search. Unit tests mocked successful responses, so the permission mismatch never surfaced in CI.
• Contributing context: The original PR (#54832, merged) assumed $search worked because it does on some other Graph collections under app-only.

Regression Test Plan

• Coverage level that should have caught this:
  • Unit test
• Target test or file: extensions/msteams/src/graph-messages.search.test.ts
• Scenario the test should lock in: The outgoing path must never contain $search, regardless of query value. New test does not use Graph $search (unsupported under Application permissions) asserts this directly.
• Why this is the smallest reliable guardrail: The failure mode is a URL-shape contract with Graph. Locking the path-building logic at the unit seam catches any regression to $search without needing a live Graph call.
• Existing test that already covers this (if any): None — prior tests only verified happy-path response parsing.

User-visible / Behavior Changes

• msteams:search now works on app-only (bot) credentials instead of returning Graph 400.
• Search range is now the most recent N messages (clamped 50–200 depending on requested limit) rather than the full conversation archive. This is a reduction in coverage for the (previously broken) Delegated-auth case, but the action was not functional under app-only at all before.
• Local filter treats message bodies as HTML by default (stripping tags before matching), and only skips the strip for contentType: "text".

Diagram

Before (broken for app-only):
search(query="hi") -> GET /chats/{id}/messages?$search="hi"  -> HTTP 400: Search not supported

After:
search(query="hi") -> GET /chats/{id}/messages?$top=50 (+ optional $filter)
                   -> stripHtml(body) when contentType=html
                   -> local includes("hi") -> return up to limit

Security Impact (required)

• New permissions/capabilities? No — uses the same Graph scopes already required for the action.
• Secrets/tokens handling changed? No
• New/changed network calls? No new endpoints. Same /chats/{id}/messages and /teams/*/channels/*/messages endpoints, different query string.
• Command/tool execution surface changed? No
• Data access scope changed? No — identical data returned, just filtered locally instead of server-side.

Repro + Verification

Environment

• OS: macOS 24.5.0 (Darwin)
• Runtime/container: Node v25.9.0, pnpm
• Model/provider: N/A (API-path fix, no model interaction)
• Integration/channel: msteams bundled plugin, Application permissions (app-only bot token)
• Relevant config: N/A

Steps

1. Configure an msteams bot with app-only (Application-permission) credentials.
2. Send messages to a chat where the bot is a member.
3. Invoke the msteams:search action against that chat with any query.

Expected

• Matching messages returned.

Actual (before this PR)

• Graph returned HTTP 400: Search is not supported on this organization regardless of query.

Actual (after this PR)

• Matching messages returned. Reproduced via unit tests covering $search removal, HTML stripping, $filter pushdown for sender, pagination window sizing, and user: target resolution.

Evidence

• Failing test/log before + passing after: extensions/msteams/src/graph-messages.search.test.ts now has 17 assertions locking the new contract; one specifically asserts the path never contains $search.
• Targeted run: pnpm test extensions/msteams/src/graph-messages.search.test.ts → 17/17 passing.
• Full extension lane: pnpm test extensions/msteams → 874/874 passing (68 files).
• Typecheck: pnpm tsgo:prod and pnpm check:test-types both green.
• Lint: pnpm lint:extensions → 0 warnings, 0 errors.
• Format: pnpm format:check extensions/msteams/src/graph-messages*.ts → clean.

Human Verification (required)

• Verified scenarios:
  • $search is absent from the outgoing query string (asserted by unit test)
  • Case-insensitive local filtering works
  • HTML-tagged bodies are stripped before matching (query <b> does not match <b>world</b>)
  • @mention display names are preserved for matching
  • contentType: "text" bodies pass through unstripped
  • user:<aadId> targets resolve through the conversation store
  • Sender $filter escaping handles single quotes (e.g., O'Brien → O''Brien)
• Edge cases checked:
  • Empty query (after quote strip) returns the full list window
  • Missing contentType defaults to HTML-safe (strip) rather than raw
  • Channel target (teamId/channelId) routes through channel path
  • Result cap honors the effective limit after local filtering
• What I did NOT verify: Live Graph API round-trip against a real tenant (no test Graph tenant available). The Graph-behavior claim ($search blocked under Application permissions) matches Microsoft's documented constraint referenced by the issue reporter and the Microsoft Graph known issue.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? Yes — same action shape, same result type, same caller contract.
• Config/env changes? No
• Migration needed? No

Risks and Mitigations

• Risk: Search now only covers the most recent 50–200 messages instead of the full archive.
  • Mitigation: Documented in the JSDoc on searchMessagesMSTeams. Full-archive search requires Delegated auth and is a separate follow-up. The prior behavior was fully broken under app-only, so this is net-positive.
• Risk: HTML-strip default broadens — any non-text contentType now goes through stripHtmlFromTeamsMessage.
  • Mitigation: The strip function is regex-based and a no-op on non-tagged content. A dedicated unit test asserts contentType: "text" bodies are NOT stripped.

AI/Vibe-Coded PR Disclosure

• Marked as AI-assisted — built with Claude Code.
• Degree of testing: Fully tested locally (unit + typecheck + lint + format) but not verified against a live Graph tenant.
• Confirm I understand what the code does: Yes.
• Bot review conversations will be addressed or replied to.

CC msteams maintainers per CONTRIBUTING: @onutc @osolmaz

Changed files

• CHANGELOG.md (modified, +1/-0)
• extensions/msteams/src/graph-messages.search.test.ts (modified, +238/-35)
• extensions/msteams/src/graph-messages.ts (modified, +66/-13)