Bug Description

When sending file attachments in MS Teams direct messages (DMs), OpenClaw fails to download the files. The Graph API fallback returns 404 due to two issues in URL construction.

Environment

• OpenClaw version: 2026.3.2
• MS Teams plugin: @openclaw/[email protected]
• Bot type: Azure Bot (Single Tenant)
• Tunnel: ngrok (HTTPS)
• Node: v22.22.0

Steps to Reproduce

1. Configure OpenClaw with MS Teams channel via ngrok tunnel
2. Send a file attachment in a DM to the bot (e.g., a PDF or DOCX)
3. Observe graph media fetch empty in debug logs

Root Cause Analysis

Issue 1: Attachment type in DM via ngrok

When using an ngrok tunnel, Teams sends file attachments as text/html (link references) instead of application/vnd.microsoft.teams.file.download.info (with direct downloadUrl). This causes downloadMSTeamsAttachments() in attachments/download.ts to return empty (no downloadable candidates found).

Issue 2: Graph API URL construction errors in buildMSTeamsGraphMessageUrls

When falling back to Graph API, buildMSTeamsGraphMessageUrls() in attachments/graph.ts constructs an invalid URL:

Actual URL generated:

https://graph.microsoft.com/v1.0/chats/a%3A1r-S5_IUUWUcyQY2klpXUwx9ekaAdRPIg8lmh_F6KaHg4zT-3J7KGlKotX3QdibbOzHpVNO4zm08HqkepgZe8ajcWMwBIKCikTjUSUyNyR_Q5qMk-PR6pb7yvjQo5z3ly/messages/1772701673666%22

Two problems:

1. chatId format mismatch: The Bot Framework conversationId (a:xxx format) is used directly as Graph API chatId, but Graph API expects 19:[email protected] format. These are different identifiers.

2. Trailing quote in messageId: The messageId ends with %22 (URL-encoded "), suggesting a stray double-quote character is included when extracting the message ID from the activity.

Debug log output (attempts)

[
  {
    "url": "https://graph.microsoft.com/v1.0/chats/a%3A1r-S5_.../messages/1772701673666%22",
    "hostedStatus": 404,
    "attachmentStatus": 404,
    "hostedCount": 0,
    "attachmentCount": 0
  }
]

Both hostedStatus and attachmentStatus return 404 because the URL is malformed.

Expected Behavior

• File attachments in DMs should be downloadable regardless of tunnel type
• Graph API URLs should use the correct chatId format (mapped from Bot Framework conversationId)
• messageId should not contain trailing quote characters

Relevant Source Files

• extensions/msteams/src/attachments/graph.ts — buildMSTeamsGraphMessageUrls() (line 51-120) and downloadMSTeamsGraphMedia() (line 234-393)
• extensions/msteams/src/attachments/download.ts — downloadMSTeamsAttachments() (line 158-262)
• extensions/msteams/src/monitor-handler/inbound-media.ts — resolveMSTeamsInboundMedia() (line 16-128)

Azure App Permissions (all granted with admin consent)

• ChannelMessage.Read.All (Application)
• Chat.Read.All (Application)
• Files.Read.All (Application)
• Sites.ReadWrite.All (Application)

Workaround

None currently. Users cannot send file attachments to the bot in DMs when using ngrok tunnel.