Best possible solution:

Land this focused cache cap after a current-main refresh and exact-head checks, then close the superseded source PR with contributor credit preserved.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level: drive current main resolveTeamGroupId through 501 distinct successful Graph lookups and the Map can grow past 500 because successful inserts are not pruned. I did not execute the repro in this read-only review.

Is this the best way to solve the issue?

Yes. Pruning the existing Map immediately after successful insertion with the shared helper is narrower than adding local LRU logic or a config knob, and it preserves cache hit, miss, TTL, and fallback behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 3fd52514e35f.

Label changes:

• add P2: This fixes a bounded Microsoft Teams process-memory risk in a channel helper with limited blast radius and no evidence of a live outage or security incident.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real-behavior proof is not treated as a contributor gate for this maintainer-labeled replacement PR; merge should still wait for the promised exact-head proof/checks.

Label justifications:

• P2: This fixes a bounded Microsoft Teams process-memory risk in a channel helper with limited blast radius and no evidence of a live outage or security incident.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real-behavior proof is not treated as a contributor gate for this maintainer-labeled replacement PR; merge should still wait for the promised exact-head proof/checks.

PR surface:

Source +4, Tests +31. Total +35 across 2 files.

What I checked:

• Current main still has a TTL-only cache: Current main defines teamGroupIdCache and writes successful resolveTeamGroupId lookups without any size pruning, so the central problem remains present. (extensions/msteams/src/graph-thread.ts:83, 3fd52514e35f)
• PR head applies the cap at the right runtime point: The PR imports pruneMapToMaxSize, defines a 500-entry cap, and prunes immediately after the successful cache insertion while keeping failure fallback uncached. (extensions/msteams/src/graph-thread.ts:90, a8c2db160427)
• Regression covers overflow and reinsertion: The added test fills 500 distinct Teams ids, inserts a 501st id, verifies the oldest entry is evicted, and proves a later lookup fetches and reinserts that key. (extensions/msteams/src/graph-thread.test.ts:127, a8c2db160427)
• Shared helper contract matches the intended eviction semantics: pruneMapToMaxSize deletes insertion-ordered oldest Map keys until the map fits the limit, which is the eviction behavior the PR relies on. (src/infra/map-size.ts:13, 3fd52514e35f)
• Plugin SDK boundary is valid: openclaw/plugin-sdk/collection-runtime is an exported SDK subpath and currently re-exports the bounded-map helper, so the extension import follows the plugin boundary guidance. (package.json:787, 3fd52514e35f)
• Runtime caller is the Teams thread-context path: Incoming Teams channel replies call resolveTeamGroupId before fetching parent and reply context, so the cache is on the live thread-context path rather than dead code. (extensions/msteams/src/monitor-handler/message-handler.ts:659, 3fd52514e35f)

Likely related people:

• velanir-ai-manager: Merged PR history and blame show this account authored the PR that introduced graph-thread.ts, the TTL-only teamGroupIdCache, and the Teams thread-context caller path. (role: introduced current behavior; confidence: high; commits: e84a0dde175e; files: extensions/msteams/src/graph-thread.ts, extensions/msteams/src/graph-thread.test.ts, extensions/msteams/src/monitor-handler/message-handler.ts)
• steipete: Live PR history shows this account merged the current Teams quote/thread-history work, is assigned to this maintainer replacement, and authored the current head commit. (role: merger and recent area owner; confidence: high; commits: e84a0dde175e, a8c2db160427; files: extensions/msteams/src/graph-thread.ts, extensions/msteams/src/graph-thread.test.ts, extensions/msteams/src/monitor-handler/message-handler.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.