Problem\nOn macOS (Homebrew / global npm installs), the bundled Microsoft Teams channel () can fail at runtime with:\n\n> Cannot find module '@microsoft/agents-hosting'\n\nRoot cause: ships as files, but the root package did not install the runtime deps required by the bundled msteams extension, so Node module resolution fails in global installs.\n\n### Fix\nAdd the required packages to the root so they are installed alongside OpenClaw in all install modes.\n\n### Notes\nThis is intentionally minimal (no runtime behavior changes aside from ensuring deps are present). A follow-up could add a release-check gate to prevent manifests from shipping in bundled extensions and/or change how bundled extensions are packaged.\n\n### How to verify\n- Install OpenClaw globally (npm/Homebrew).\n- Enable/configure msteams.\n- Confirm OpenClaw status

Overview
┌─────────────────┬───────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Item │ Value │
├─────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Dashboard │ http://127.0.0.1:18789/ │
│ OS │ macos 26.2 (arm64) · node 24.4.1 │
│ Tailscale │ off │
│ Channel │ stable (default) │
│ Update │ pnpm · npm latest 2026.2.13 │
│ Gateway │ local · ws://127.0.0.1:18789 (local loopback) · reachable 25ms · auth token · macbookpro.lan │
│ │ (192.168.86.24) app unknown macos 26.2 │
│ Gateway service │ LaunchAgent installed · loaded · running (pid 48479, state active) │
│ Node service │ LaunchAgent not installed │
│ Agents │ 2 · 1 bootstrapping · sessions 30 · default main active just now │
│ Memory │ 16 files · 16 chunks · sources memory · plugin memory-core · vector ready │
│ Probes │ enabled │
│ Events │ none │
│ Heartbeat │ 30m (main), disabled (dao) │
│ Last heartbeat │ sent · 7m ago ago · msteams · account default │
│ Sessions │ 30 active · default claude-opus-4-6-thinking (200k ctx) · 2 stores │
└─────────────────┴───────────────────────────────────────────────────────────────────────────────────────────────────┘

Security audit
Summary: 1 critical · 2 warn · 1 info
CRITICAL Telegram DMs are open
channels.telegram.dmPolicy="open" allows anyone to DM the bot.
Fix: Use pairing/allowlist; if you really need open DMs, ensure channels.telegram.allowFrom includes "*".
WARN Extension plugin tools may be reachable under permissive tool policy
Enabled extension plugins: msteams. Permissive tool policy contexts: - default - agents.list.main - agents.list.Dao
Fix: Use restrictive profiles (minimal/coding) or explicit tool allowlists that exclude plugin tools for agents handling untrusted input.
WARN Telegram DMs share the main session
Multiple DM senders currently share the main session, which can leak context across users.
Fix: Run: openclaw config set session.dmScope "per-channel-peer" (or "per-account-channel-peer" for multi-account channels) to isolate DM sessions per sender.
Full report: openclaw security audit
Deep probe: openclaw security audit --deep

Channels
┌─────────────────┬─────────┬────────┬────────────────────────────────────────────────────────────────────────────────┐
│ Channel │ Enabled │ State │ Detail │
├─────────────────┼─────────┼────────┼────────────────────────────────────────────────────────────────────────────────┤
│ Telegram │ ON │ OK │ token config (8412…TvvE · len 46) · accounts 1/1 │
│ Microsoft Teams │ ON │ OK │ configured │
└─────────────────┴─────────┴────────┴────────────────────────────────────────────────────────────────────────────────┘

Sessions
┌──────────────────────────────────────────────────┬────────┬──────────┬──────────────────────────┬───────────────────┐
│ Key │ Kind │ Age │ Model │ Tokens │
├──────────────────────────────────────────────────┼────────┼──────────┼──────────────────────────┼───────────────────┤
│ agent:main:main │ direct │ just now │ claude-opus-4-6-thinking │ unknown/200k (?%) │
│ agent:main:msteams:group:19:7ef… │ group │ just now │ gpt-5.3-codex │ 171k/272k (63%) │
│ agent:dao:main │ direct │ 1m ago │ claude-opus-4-6-thinking │ unknown/200k (?%) │
│ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 2m ago │ gpt-5.3-codex │ 13k/272k (5%) │
│ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 2m ago │ gpt-5.3-codex │ 13k/272k (5%) │
│ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 3h ago │ gpt-5.3-codex │ 13k/272k (5%) │
│ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 4h ago │ gpt-5.3-codex │ 14k/272k (5%) │
│ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 4h ago │ gpt-5.3-codex │ 14k/272k (5%) │
│ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 4h ago │ gpt-5.3-codex │ 14k/272k (5%) │
│ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 5h ago │ gpt-5.3-codex │ 17k/272k (6%) │
└──────────────────────────────────────────────────┴────────┴──────────┴──────────────────────────┴───────────────────┘

Health
┌─────────────────┬───────────┬───────────────────────────────────────────────────────────────────────────────────────┐
│ Item │ Status │ Detail │
├─────────────────┼───────────┼───────────────────────────────────────────────────────────────────────────────────────┤
│ Gateway │ reachable │ 420ms │
│ Telegram │ OK │ ok (@assistaobot:default:219ms) │
│ Microsoft Teams │ OK │ ok (default:default:ok) │
└─────────────────┴───────────┴───────────────────────────────────────────────────────────────────────────────────────┘

FAQ: https://docs.openclaw.ai/faq
Troubleshooting: https://docs.openclaw.ai/troubleshooting

Next steps:
Need to share? openclaw status --all
Need to debug live? openclaw logs --follow
Need to test channels? openclaw status --deep shows Microsoft Teams: OK and no missing-module error.

Greptile Summary

Fixes a runtime Cannot find module '@microsoft/agents-hosting' crash that occurs when the bundled msteams extension is used via global npm or Homebrew installs. The root cause is that bundled extensions ship as files inside the main openclaw package (via the files: ["extensions/"] entry), but their node_modules are not included — so Node's module resolution can't find @microsoft/agents-hosting* unless those packages are also declared in the root package.json.

• Adds @microsoft/agents-hosting, @microsoft/agents-hosting-express, and @microsoft/agents-hosting-extensions-teams (^1.2.3) to root dependencies, matching the versions already declared in extensions/msteams/package.json
• This intentionally diverges from the AGENTS.md guideline ("keep plugin-only deps in the extension package.json") as a pragmatic fix for the bundled install path — the PR description notes a follow-up to improve how bundled extensions are packaged
• The pnpm-lock.yaml is not updated in this PR; a pnpm install will be needed to regenerate it

Confidence Score: 4/5

• This PR is safe to merge — it only adds dependency declarations with no runtime code changes.
• The change is minimal and well-scoped: three new dependency entries in root package.json that mirror existing declarations in the msteams extension. No runtime behavior changes. The only concern is the missing pnpm-lock.yaml update, which is a minor process issue rather than a correctness problem. The version ranges are consistent between root and extension.
• No files require special attention. The pnpm-lock.yaml will need to be regenerated after merge.

_{Last reviewed commit: 3ecaae4}

_{(2/5) Greptile learns from your feedback when you react with thumbs up/down!}

Context used:

• Context from dashboard - CLAUDE.md (source)