spacedriveapp · slvnlrt · Jun 29, 2026 · Jun 29, 2026 · Jun 29, 2026 · Jun 30, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -149,6 +149,9 @@ bollard = "0.18"
 # Semver parsing (for update version comparison)
 semver = "1"
 
+# JWT validation for inbound Bot Framework requests (ring-based, no openssl)
+jsonwebtoken = "9.3"
+
 # Skill installation
 zip = "2"
 tempfile = "3"

diff --git a/docs/content/docs/(messaging)/messaging.mdx b/docs/content/docs/(messaging)/messaging.mdx
@@ -1,6 +1,6 @@
 ---
 title: Messaging
-description: How Spacebot connects to Discord, Slack, Telegram, Twitch, Email, and webhooks.
+description: How Spacebot connects to Discord, Slack, Microsoft Teams, Telegram, Twitch, Email, and webhooks.
 ---
 
 # Messaging
@@ -13,6 +13,7 @@ Spacebot connects to chat platforms so your agent can talk to people where they
 |----------|--------|-------------|
 | [Discord](/docs/discord-setup) | Supported | Bot token + gateway connection |
 | [Slack](/docs/slack-setup) | Supported | Bot token + app token via Socket Mode |
+| [Microsoft Teams](/docs/teams-setup) | Supported | Azure Bot + Entra app, public HTTPS endpoint |
 | [Telegram](/docs/telegram-setup) | Supported | Bot token via BotFather |
 | [Twitch](/docs/twitch-setup) | Supported | OAuth token via Twitch IRC |
 | [Email](/docs/email-setup) | Supported | IMAP polling + SMTP replies |

diff --git a/docs/content/docs/(messaging)/meta.json b/docs/content/docs/(messaging)/meta.json
@@ -1,4 +1,4 @@
 {
   "title": "Messaging",
-  "pages": ["messaging", "discord-setup", "slack-setup", "telegram-setup", "twitch-setup", "email-setup"]
+  "pages": ["messaging", "discord-setup", "slack-setup", "teams-setup", "telegram-setup", "twitch-setup", "email-setup"]
 }
diff --git a/docs/content/docs/(messaging)/teams-setup.mdx b/docs/content/docs/(messaging)/teams-setup.mdx
@@ -0,0 +1,107 @@
+---
+title: Teams Setup
+description: Connect Spacebot to Microsoft Teams.
+---
+
+# Teams Setup
+
+Connect Spacebot to Microsoft Teams as a bot. Teams talks to your bot over the Azure Bot Service, so this takes a bit more setup than the other channels: an Entra (Azure AD) app registration, an Azure Bot resource, a Teams app package, and a public HTTPS endpoint Microsoft can reach.
+
+You need three values from Azure — an **App ID**, a **Client Secret**, and a **Tenant ID** — plus a public URL that forwards to Spacebot.
+
+<Callout type="warn">
+Teams requires a **public HTTPS endpoint**. The bot does not connect outbound like Slack; the Azure Bot Service delivers messages by POSTing to a URL you register. A localhost bind is not reachable. Put Spacebot behind a reverse proxy (Caddy, nginx) or a tunnel (cloudflared) that terminates TLS and forwards to the bot's port.
+</Callout>
+
+## Step 1: Register an Entra app
+
+In the [Azure portal](https://portal.azure.com), go to **Microsoft Entra ID** → **App registrations** → **New registration**.
+
+Name it (e.g. "Spacebot"), pick the supported account types for your org, and register.
+
+From the app's **Overview**, copy the **Application (client) ID** and the **Directory (tenant) ID**.
+
+Then go to **Certificates & secrets** → **New client secret**, create one, and copy its **Value** immediately (it is shown only once). This is your **Client Secret**.
+
+## Step 2: Create the Azure Bot
+
+Create an **Azure Bot** resource (the free **F0** SKU is enough). Point it at the app you just registered (use the existing App ID rather than creating a new identity).
+
+In the bot's **Configuration**, set the **Messaging endpoint** to your public URL with the `/api/messages` path:
+
+```
+https://your-public-host/api/messages
+```
+
+Then open **Channels** and add the **Microsoft Teams** channel.
+
+## Step 3: Build and install the Teams app
+
+Teams needs an app package (a zip with a `manifest.json` and two icons) to surface the bot to users.
+
+<Callout type="info">
+The manifest `id` (the Teams app id) must be its **own** GUID, distinct from the bot's App ID. `bots[].botId` is the App ID from Step 1. Scopes are lowercase (`personal`, `team`, `groupchat`), and `validDomains` plus an `accentColor` are required.
+</Callout>
+
+Upload the package in Teams (**Apps** → **Manage your apps** → **Upload an app**). Most tenants require admin approval: approve it in the **Teams admin center** under **Manage apps**, where you can also restrict who may install it.
+
+## Step 4: Configure Spacebot
+
+Add a `[messaging.teams]` block to your config. Keep the client secret out of the file by referencing an environment variable.
+
+```toml
+[messaging.teams]
+enabled = true
+
+# App ID and Tenant ID from Step 1 (not secret).
+app_id    = "00000000-0000-0000-0000-000000000000"
+tenant_id = "00000000-0000-0000-0000-000000000000"
+
+# Reference the secret from the environment; never hardcode it.
+client_secret = "env:TEAMS_CLIENT_SECRET"
+
+# Inbound listener. The reverse proxy / tunnel forwards here.
+port = 3979
+bind = "0.0.0.0"
+
+# Teams user IDs allowed to DM the bot. "*" allows everyone.
+dm_allowed_users = ["*"]
+
+[[bindings]]
+agent_id = "main"
+channel  = "teams"
+```
+
+Start Spacebot with the secret in the environment:
+
+```bash
+TEAMS_CLIENT_SECRET="your-secret-value" spacebot start
+```
+
+## DM permissions
+
+Channel and group messages are open: the bot replies wherever it is @mentioned. Direct messages are **fail-closed** — an empty `dm_allowed_users` blocks every DM.
+
+- To allow specific people, list their Teams user IDs (the `29:...` MRI strings).
+- To allow everyone (org-wide deployments), set `dm_allowed_users = ["*"]`.
+
+<Callout type="info">
+You usually do not know a user's `29:...` MRI up front. The simplest path is to **@mention the bot in a channel** (channel messages are not gated), or set the `"*"` wildcard. To allowlist one person, send a DM once (it is dropped), read the dropped `sender_id` from the logs, and add that value.
+</Callout>
+
+## What works
+
+| Capability | Notes |
+|------------|-------|
+| Text replies | Plain text in DMs, channels, and group chats |
+| @mentions | The bot responds when @mentioned in a channel or group |
+| Adaptive Cards | Structured cards rendered from rich replies |
+| Typing indicator | Shown while the bot is working |
+| Inbound files and images | Delivered to the agent (personal scope) |
+| Buttons | Adaptive Card buttons; a click comes back to the agent |
+
+## Limitations
+
+- **One Teams bot per instance.** A single default `[messaging.teams]` adapter is supported. Named multi-bot instances are not yet available.
+- **Files are personal-scope.** Inbound file attachments work in 1:1 chats; channel files require Microsoft Graph and are out of scope.
+- **Rotate the client secret** before relying on it in production, and keep it in the environment rather than the config file.
diff --git a/src/agent/channel.rs b/src/agent/channel.rs
@@ -3886,6 +3886,13 @@ fn compute_listen_mode_invocation(message: &InboundMessage, raw_text: &str) -> (
             .get("twitch_mentions_or_replies_to_bot")
             .and_then(|v| v.as_bool())
             .unwrap_or(false),
+        "teams" => {
+            message
+                .metadata
+                .get("teams_mentioned")
+                .and_then(|v| v.as_str())
+                == Some("true")
+        }
         _ => false,
     };
     let invoked_by_reply = match message.source.as_str() {
@@ -4453,6 +4460,36 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn teams_mention_metadata_true_string_yields_invoked_by_mention() {
+        let message = inbound_message(
+            "teams",
+            &[("teams_mentioned", serde_json::Value::String("true".into()))],
+            "hey bot",
+        );
+
+        let (invoked_by_command, invoked_by_mention, invoked_by_reply) =
+            compute_listen_mode_invocation(&message, "hey bot");
+
+        assert!(!invoked_by_command);
+        assert!(invoked_by_mention);
+        assert!(!invoked_by_reply);
+    }
+
+    #[test]
+    fn teams_mention_metadata_false_string_does_not_invoke() {
+        let message = inbound_message(
+            "teams",
+            &[("teams_mentioned", serde_json::Value::String("false".into()))],
+            "hey bot",
+        );
+
+        let (_invoked_by_command, invoked_by_mention, _invoked_by_reply) =
+            compute_listen_mode_invocation(&message, "hey bot");
+
+        assert!(!invoked_by_mention);
+    }
+
     #[test]
     fn is_dm_conversation_id_detects_dm_patterns() {
         // Slack DMs — channel ID starts with 'D'

diff --git a/src/config.rs b/src/config.rs
@@ -16,7 +16,7 @@ pub use load::set_resolve_secrets_store;
 pub use onboarding::run_onboarding;
 pub use permissions::{
     DiscordPermissions, MattermostPermissions, SignalPermissions, SlackPermissions,
-    TelegramPermissions, TwitchPermissions,
+    TeamsPermissions, TelegramPermissions, TwitchPermissions,
 };
 pub(crate) use providers::default_provider_config;
 pub use runtime::RuntimeConfig;
@@ -1637,6 +1637,7 @@ id = "main"
             twitch: None,
             signal: None,
             mattermost: None,
+            teams: None,
         };
         let bindings = vec![
             Binding {
@@ -1687,6 +1688,7 @@ id = "main"
             twitch: None,
             signal: None,
             mattermost: None,
+            teams: None,
         };
         let bindings = vec![Binding {
             agent_id: "main".into(),
@@ -1755,6 +1757,7 @@ id = "main"
             twitch: None,
             signal: None,
             mattermost: None,
+            teams: None,
         };
         let bindings = vec![Binding {
             agent_id: "main".into(),
@@ -1798,6 +1801,7 @@ id = "main"
             twitch: None,
             signal: None,
             mattermost: None,
+            teams: None,
         };
         // Binding targets default adapter, but no default credentials exist
         let bindings = vec![Binding {
@@ -1842,6 +1846,7 @@ id = "main"
             twitch: None,
             signal: None,
             mattermost: None,
+            teams: None,
         };
         let bindings = vec![
             // Valid: default adapter with credentials
@@ -1923,6 +1928,7 @@ id = "main"
             twitch: None,
             signal: None,
             mattermost: None,
+            teams: None,
         };
         let bindings = vec![Binding {
             agent_id: "main".into(),
@@ -1956,6 +1962,7 @@ id = "main"
             twitch: None,
             signal: None,
             mattermost: None,
+            teams: None,
         };
         let bindings = vec![Binding {
             agent_id: "main".into(),
@@ -1998,6 +2005,7 @@ id = "main"
             twitch: None,
             signal: None,
             mattermost: None,
+            teams: None,
         };
         let bindings = vec![Binding {
             agent_id: "main".into(),
@@ -2036,6 +2044,7 @@ id = "main"
             twitch: None,
             signal: None,
             mattermost: None,
+            teams: None,
         };
         let bindings = vec![Binding {
             agent_id: "main".into(),