…o option

Addresses the two author-side review findings on the inbound provider:

- [P1] Teams allowlists now match AAD callers. isAllowlistedCaller matches by
  phone number (digits) OR by exact caller id (case-insensitive), so a Teams
  aadId is no longer phone-normalized into a non-matching value. The msteams
  paths (realtime isInboundCallAllowed + streaming shouldAcceptInbound) pass the
  raw caller id; carrier paths still match by phone. Tests cover AAD-id matching.
- [P2] Wire the documented realtime echo option. realtime.suppressInputDuringPlayback
  is now a real config field (schema + manifest + threaded into the msteams
  realtime deps), matching the README; it was previously documented but only an
  internal default.

oxlint/oxfmt/tsgo prod+test clean; allowlist + webhook + config suites green;
base-config-schema unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Completes the allowlist fix. Runtime matching already accepted AAD caller ids,
but config + manifest validation still required E.164 for every allowFrom entry,
so `inboundPolicy: "allowlist"` was unusable for Teams (a GUID failed validation
before runtime ever saw it). allowFrom entries now accept an E.164 phone number
OR a Teams AAD object id (GUID) in both the Zod schema and the plugin manifest;
README documents the AAD-id form. Carrier providers are unchanged (E.164).

Tests cover the schema accepting phone + GUID (either case) and rejecting
non-E.164/non-GUID entries.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Addresses the reviewer's inbound-posture decision: msteams previously defaulted
inboundPolicy to "open", accepting every authenticated Teams caller out of the
box. It now defaults to an allowlist-oriented policy — with an empty allowFrom no
caller is accepted until the operator opts callers in (the allowlist accepts AAD
object ids) or sets inboundPolicy: "open" explicitly. No unsafe default; explicit
policies are honored unchanged. README + tests updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

[P3] Keep manifest provider metadata in sync — the provider enum includes
"msteams" but the human-readable description still only listed Twilio/Telnyx/
Plivo. Mention Microsoft Teams voice so the manifest metadata matches.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

[P1/P2] The public voice-call docs described only Twilio/Telnyx/Plivo/mock, so
the new msteams provider shipped undocumented. Add it to the summary and
provider list and add a "Microsoft Teams voice (msteams)" section covering the
external Windows-worker WebSocket bridge, streaming vs realtime modes, the safe
allowlist default + AAD-id allowFrom, the recording-status gate, and the
HMAC/loopback security model, linking to the extension README for the full
protocol.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ty in session keys

Two source-review defects:

- Socket-close teardown: a started Teams session that dropped without an explicit
  session.end frame (worker crash, network loss, hangup) only released local
  connection tracking — onSessionEnd never fired, so the provider/manager call
  record leaked until the stale-call reaper. The ws "close" handler now delivers
  onSessionEnd (reason "socket-closed") for a started-but-not-ended session,
  guarded against double-delivery when an explicit session.end preceded it.

- Session-key caller identity: when a Teams caller has no aadId, `from` fell back
  to the shared literal "teams", so every anonymous caller collided into one
  session key (cross-caller memory bleed under sessionScope: per-phone) and would
  match an allowlist as a generic caller. Fall back to a per-call-unique
  `teams:<callId>` instead; the AAD id is still preferred when present.

Tests cover abrupt-close onSessionEnd, no double-fire after session.end, no fire
before session.start, and the per-call-unique session key.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…arget

A realtime openclaw_agent_task delivers its result to the caller's Teams chat
(message tool -> user:<aadId>). When the bridge session has no caller.aadId
(anonymous caller), handleAsyncTask still acked "I'll message you on Teams" and
ran the task — but runAsyncTask had no delivery target, so the promised result
was silently dropped. Refuse the task up front when caller.aadId is absent,
returning a message that tells the model to offer to answer on the call instead.
Regression test covers the no-aadId refusal (no false delivery ack).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…rd Teams worker docs

- The two new socket-close tests used `(resolve) => setTimeout(resolve, 100)`,
  whose arrow body implicitly returns the timer handle — oxlint
  no-promise-executor-return. Use a block body so nothing is returned. This was
  failing both check-lint and check-additional-extension-bundled
  (lint:extensions:bundled).
- Docs: describe the Teams bridge as a "Windows-side bridge worker" rather than
  "an external Windows worker (not part of this repo)".

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

… posture

Reviewer follow-up: the setup examples showed `inboundPolicy: "open"` as the
headline, which undercuts the safe default. The README and public-docs snippets
now use `inboundPolicy: "allowlist"` with a sample AAD `allowFrom` entry, and
note `"open"` only as the explicit accept-all alternative. Matches the code/
schema default (allowlist) and the now-corrected PR description.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

OpenClaw side of inbound vision (the worker already sends video.frame). The Teams
bridge now parses the `video.frame` message (camera / screen-share JPEG), and the
provider buffers the latest frame per source — recording-gated (Media Access API,
parity with audio/transcripts) and path-agnostic (streaming + realtime) — exposing
`getLatestVideoFrame()` for an upcoming "look" tool to attach to a vision model.

Also raises the inbound WS payload cap 64 KB -> 2 MB: video frames are far larger
than audio, and the sender is the HMAC-authenticated worker, so the looser bound
only affects the trusted path. Tests cover video.frame ingestion and the new cap.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…he caller's screen/camera

Completes the inbound-vision loop (PR3). A realtime `look_at_screen` tool lets the
model answer visual questions ("what's on my screen?", "read this error"):
- pulls the latest buffered frame via the provider's getLatestVideoFrame() (per-call
  accessor threaded into the realtime deps; screen-share preferred, then camera),
- runs the OpenClaw agent over it as an image (consultRealtimeVoiceAgent now forwards
  an optional `images: ImageContent[]` to runEmbeddedAgent — a vision-capable run),
- speaks back a concise description; recording-gated like consult/transcripts.

Exposed only when the agent runtime + a frame source are available; returns a clear
"camera/share not on yet" message when no frame has arrived. Tests cover the
no-frame path and that the latest frame is passed through as an image.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…rding is active

Adds the missing recording-gate coverage for video (parity with the audio/transcript
gate tests): a video.frame before recording is active is not buffered, and frames
after recording.status=active are. setup() now returns the provider so the test can
assert getLatestVideoFrame().

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

The realtime path has look_at_screen; the streaming path runs the agent per turn, so
attach the latest shared video frame to that run (recording-gated via
getLatestVideoFrame) — the streaming agent can now answer "what's on my screen?"
in-turn. generateVoiceResponse gains an optional images param forwarded to the run.
Test covers the frame riding along on a streaming turn.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ged frame

Bounds vision-model cost: look_at_screen (realtime) caches its answer keyed by the
exact frame bytes and returns it instantly for repeat asks on an unchanged screen,
re-running only when the frame changes. The streaming path likewise attaches a frame
to the agent turn only when it changed since the last turn. Test covers the cache
hit + re-run-on-change.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…mpling delay)

…assertion, unshadow provider)

…orrelate)

Lets OpenClaw place an outbound Teams call ("call me when the task is done")
through the external worker's HMAC HTTP endpoint, reusing the inbound streaming
media bridge for the conversation/notification.

- config: msteams.outbound { enabled, workerBaseUrl, tenantId }.
- MsteamsProvider.initiateCall: signs HMAC over `${ts}.${userObjectId}` and
  POSTs {workerBaseUrl}/api/calls/place; tracks the returned callId in
  pendingOutbound; returns it as providerCallId. (Realtime outbound deferred —
  Phase 1 rides the streaming path.)
- handleSessionStart: when session.callId matches a pending outbound placement,
  attach to the existing CallRecord and emit call.answered (skipping inbound
  policy / call.initiated) so the manager speaks the result / starts the convo.
- manager/outbound: exempt msteams from the fromNumber guard (synthetic "from").
- media-stream: accept + expose the new session.start `direction` field.
- Tests: initiateCall disabled-guard + signed POST happy-path.

Worker side (separate repo): session.start now carries `direction:"outbound"`.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
(cherry picked from commit 223ee6b)

…ia:"call"

- Realtime outbound: initiateCall no longer requires the streaming path. When a
  placed call's media WS attaches under realtime mode, the speech-to-speech model
  opens the call by speaking the delivered result (greeting), then converses.
  The CallRecord is transitioned to answered without the manager re-speaking, and
  session.end finalizes it (outboundRealtimeInternalIds).
- InitiateCallInput.message threads the result through manager -> provider so the
  realtime greeting can speak it.
- openclaw_agent_task gains deliverVia ("message" | "call"): "call" makes the
  background agent place a Teams call back to the caller (voice_call initiate_call,
  notify mode) instead of sending a Teams chat message. Ack line adapts.
- Endpoint path updated to POST {workerBaseUrl}/api/calls (was /api/calls/place).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
(cherry picked from commit 19c0abd)

…lan) + tests

Fixes the UX bug where the realtime callback opened by restating the task in
future tense ("I'll find the Dubai time and call you back") instead of speaking
the finished result:
- Callback greeting now frames it as an OUTBOUND callback delivering an
  already-completed result, instructing the model to state it directly and not
  say it will look it up / call back.
- deliverVia:"call" instruction now tells the background agent to complete the
  task FIRST and pass the FINAL ANSWER as the message (with an example), not a
  description of what it is about to do.

Regression tests:
- realtime: openclaw_agent_task with deliverVia:"call" acks with a call-back line.
- provider: an outbound call placed via the worker (mocked /api/calls) attaches
  to the existing CallRecord on session.start (correlation by callId), not a new
  inbound call. (setup() gained an outbound option.)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
(cherry picked from commit 3816b4e)

Enables the Teams CHAT agent to place an outbound voice call back to the user:
- msteams channel: expose the inbound sender's Azure AD object id explicitly as
  `MsteamsAadObjectId` in the inbound context metadata (it was only implicitly
  the sender.id, conflated with the Bot Framework service id).
- voice_call tool: clarify the initiate_call `to` description — for the msteams
  provider it's the target user's AAD object id (`user:<aadObjectId>`), e.g. the
  inbound chat sender's MsteamsAadObjectId — so the agent can call a chat user back.

With this, "find X and call me when you're done" sent as a Teams chat lets the
agent run the task then invoke voice_call initiate_call to the caller's aadObjectId.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
(cherry picked from commit 7f1a3b3)

Wires the "call me back" behavior in automatically (no system-prompt edit): the
voice_call tool description now tells the agent that, to call a user back with a
result (e.g. a Teams chat user saying "call me when you find the answer"), it
should complete the task then use initiate_call with mode "notify", message =
the final answer, and (for msteams) to = "user:<aadObjectId>" sourced from the
inbound message's MsteamsAadObjectId. Combined with the explicit MsteamsAadObjectId
metadata, the chat -> outbound-call flow no longer relies on system-prompt tuning.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
(cherry picked from commit 5baa313)

…rve-caught-error)

…t timeout (no leak)

…tenantId (no duplication)

…, surface audio.frame send failures

…w audio.frame send failure, guard late answer after no-answer timeout, typed channel tenantId, provider-neutral tool desc, drop dead re-export

…ms.outbound.answerTimeoutMs), default 120s with rationale

…d type (tsgo fix)

Mirror the chat channel's group @mention gate for Teams calls: in a 1:1 call the
bot replies to everything; in a group/meeting it stays quiet until addressed by
name. A call has no structured @mention, so "addressed" is matched from the
transcript against configurable wake phrases, with a short follow-up window so a
back-and-forth doesn't need the bot's name every turn.

- group-call-gate.ts: pure, unit-tested core — isAddressed (boundary-aware),
  shouldRespondToGroupTurn (group + follow-up window), and a single
  resolveGroupCallGateConfig() defaults resolver reused by every caller.
- config: msteams.groupCall { requireAddress, wakePhrases, followUpWindowMs }.
- media-stream: `participants` message (human count) -> onParticipants.
- Streaming path: deterministic gate in handleTranscript (count-based); the
  utterance is still recorded so the agent has heard prior turns once addressed.
- Realtime path: the bridge exposes no response-suppress hook, so the gate is
  applied as a model instruction (stay silent unless addressed by name).