…o option

Addresses the two author-side review findings on the inbound provider:

- [P1] Teams allowlists now match AAD callers. isAllowlistedCaller matches by
  phone number (digits) OR by exact caller id (case-insensitive), so a Teams
  aadId is no longer phone-normalized into a non-matching value. The msteams
  paths (realtime isInboundCallAllowed + streaming shouldAcceptInbound) pass the
  raw caller id; carrier paths still match by phone. Tests cover AAD-id matching.
- [P2] Wire the documented realtime echo option. realtime.suppressInputDuringPlayback
  is now a real config field (schema + manifest + threaded into the msteams
  realtime deps), matching the README; it was previously documented but only an
  internal default.

oxlint/oxfmt/tsgo prod+test clean; allowlist + webhook + config suites green;
base-config-schema unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Completes the allowlist fix. Runtime matching already accepted AAD caller ids,
but config + manifest validation still required E.164 for every allowFrom entry,
so `inboundPolicy: "allowlist"` was unusable for Teams (a GUID failed validation
before runtime ever saw it). allowFrom entries now accept an E.164 phone number
OR a Teams AAD object id (GUID) in both the Zod schema and the plugin manifest;
README documents the AAD-id form. Carrier providers are unchanged (E.164).

Tests cover the schema accepting phone + GUID (either case) and rejecting
non-E.164/non-GUID entries.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Addresses the reviewer's inbound-posture decision: msteams previously defaulted
inboundPolicy to "open", accepting every authenticated Teams caller out of the
box. It now defaults to an allowlist-oriented policy — with an empty allowFrom no
caller is accepted until the operator opts callers in (the allowlist accepts AAD
object ids) or sets inboundPolicy: "open" explicitly. No unsafe default; explicit
policies are honored unchanged. README + tests updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

[P3] Keep manifest provider metadata in sync — the provider enum includes
"msteams" but the human-readable description still only listed Twilio/Telnyx/
Plivo. Mention Microsoft Teams voice so the manifest metadata matches.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

[P1/P2] The public voice-call docs described only Twilio/Telnyx/Plivo/mock, so
the new msteams provider shipped undocumented. Add it to the summary and
provider list and add a "Microsoft Teams voice (msteams)" section covering the
external Windows-worker WebSocket bridge, streaming vs realtime modes, the safe
allowlist default + AAD-id allowFrom, the recording-status gate, and the
HMAC/loopback security model, linking to the extension README for the full
protocol.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ty in session keys

Two source-review defects:

- Socket-close teardown: a started Teams session that dropped without an explicit
  session.end frame (worker crash, network loss, hangup) only released local
  connection tracking — onSessionEnd never fired, so the provider/manager call
  record leaked until the stale-call reaper. The ws "close" handler now delivers
  onSessionEnd (reason "socket-closed") for a started-but-not-ended session,
  guarded against double-delivery when an explicit session.end preceded it.

- Session-key caller identity: when a Teams caller has no aadId, `from` fell back
  to the shared literal "teams", so every anonymous caller collided into one
  session key (cross-caller memory bleed under sessionScope: per-phone) and would
  match an allowlist as a generic caller. Fall back to a per-call-unique
  `teams:<callId>` instead; the AAD id is still preferred when present.

Tests cover abrupt-close onSessionEnd, no double-fire after session.end, no fire
before session.start, and the per-call-unique session key.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…arget

A realtime openclaw_agent_task delivers its result to the caller's Teams chat
(message tool -> user:<aadId>). When the bridge session has no caller.aadId
(anonymous caller), handleAsyncTask still acked "I'll message you on Teams" and
ran the task — but runAsyncTask had no delivery target, so the promised result
was silently dropped. Refuse the task up front when caller.aadId is absent,
returning a message that tells the model to offer to answer on the call instead.
Regression test covers the no-aadId refusal (no false delivery ack).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

… posture

Reviewer follow-up: the setup examples showed `inboundPolicy: "open"` as the
headline, which undercuts the safe default. The README and public-docs snippets
now use `inboundPolicy: "allowlist"` with a sample AAD `allowFrom` entry, and
note `"open"` only as the explicit accept-all alternative. Matches the code/
schema default (allowlist) and the now-corrected PR description.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

OpenClaw side of inbound vision (the worker already sends video.frame). The Teams
bridge now parses the `video.frame` message (camera / screen-share JPEG), and the
provider buffers the latest frame per source — recording-gated (Media Access API,
parity with audio/transcripts) and path-agnostic (streaming + realtime) — exposing
`getLatestVideoFrame()` for an upcoming "look" tool to attach to a vision model.

Also raises the inbound WS payload cap 64 KB -> 2 MB: video frames are far larger
than audio, and the sender is the HMAC-authenticated worker, so the looser bound
only affects the trusted path. Tests cover video.frame ingestion and the new cap.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…he caller's screen/camera

Completes the inbound-vision loop (PR3). A realtime `look_at_screen` tool lets the
model answer visual questions ("what's on my screen?", "read this error"):
- pulls the latest buffered frame via the provider's getLatestVideoFrame() (per-call
  accessor threaded into the realtime deps; screen-share preferred, then camera),
- runs the OpenClaw agent over it as an image (consultRealtimeVoiceAgent now forwards
  an optional `images: ImageContent[]` to runEmbeddedAgent — a vision-capable run),
- speaks back a concise description; recording-gated like consult/transcripts.

Exposed only when the agent runtime + a frame source are available; returns a clear
"camera/share not on yet" message when no frame has arrived. Tests cover the
no-frame path and that the latest frame is passed through as an image.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…rding is active

Adds the missing recording-gate coverage for video (parity with the audio/transcript
gate tests): a video.frame before recording is active is not buffered, and frames
after recording.status=active are. setup() now returns the provider so the test can
assert getLatestVideoFrame().

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

The realtime path has look_at_screen; the streaming path runs the agent per turn, so
attach the latest shared video frame to that run (recording-gated via
getLatestVideoFrame) — the streaming agent can now answer "what's on my screen?"
in-turn. generateVoiceResponse gains an optional images param forwarded to the run.
Test covers the frame riding along on a streaming turn.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ged frame

Bounds vision-model cost: look_at_screen (realtime) caches its answer keyed by the
exact frame bytes and returns it instantly for repeat asks on an unchanged screen,
re-running only when the frame changes. The streaming path likewise attaches a frame
to the agent turn only when it changed since the last turn. Test covers the cache
hit + re-run-on-change.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…mpling delay)

…assertion, unshadow provider)