#16606: Fix Teams plugin: ship required @microsoft/agents-hosting deps in bundled installs

### Problem\nOn macOS (Homebrew / global npm installs), the bundled Microsoft Teams channel () can fail at runtime with:\n\n> Cannot find module '@microsoft/agents-hosting'\n\nRoot cause: ships as files, but the root package did not install the runtime deps required by the bundled msteams extension, so Node module resolution fails in global installs.\n\n### Fix\nAdd the required packages to the root so they are installed alongside OpenClaw in all install modes.\n\n### Notes\nThis is intentionally minimal (no runtime behavior changes aside from ensuring deps are present). A follow-up could add a release-check gate to prevent manifests from shipping in bundled extensions and/or change how bundled extensions are packaged.\n\n### How to verify\n- Install OpenClaw globally (npm/Homebrew).\n- Enable/configure msteams.\n- Confirm OpenClaw status Overview ┌─────────────────┬───────────────────────────────────────────────────────────────────────────────────────────────────┐ │ Item │ Value │ ├─────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Dashboard │ http://127.0.0.1:18789/ │ │ OS │ macos 26.2 (arm64) · node 24.4.1 │ │ Tailscale │ off │ │ Channel │ stable (default) │ │ Update │ pnpm · npm latest 2026.2.13 │ │ Gateway │ local · ws://127.0.0.1:18789 (local loopback) · reachable 25ms · auth token · macbookpro.lan │ │ │ (192.168.86.24) app unknown macos 26.2 │ │ Gateway service │ LaunchAgent installed · loaded · running (pid 48479, state active) │ │ Node service │ LaunchAgent not installed │ │ Agents │ 2 · 1 bootstrapping · sessions 30 · default main active just now │ │ Memory │ 16 files · 16 chunks · sources memory · plugin memory-core · vector ready │ │ Probes │ enabled │ │ Events │ none │ │ Heartbeat │ 30m (main), disabled (dao) │ │ Last heartbeat │ sent · 7m ago ago · msteams · account default │ │ Sessions │ 30 active · default claude-opus-4-6-thinking (200k ctx) · 2 stores │ └─────────────────┴───────────────────────────────────────────────────────────────────────────────────────────────────┘ Security audit Summary: 1 critical · 2 warn · 1 info CRITICAL Telegram DMs are open channels.telegram.dmPolicy="open" allows anyone to DM the bot. Fix: Use pairing/allowlist; if you really need open DMs, ensure channels.telegram.allowFrom includes "*". WARN Extension plugin tools may be reachable under permissive tool policy Enabled extension plugins: msteams. Permissive tool policy contexts: - default - agents.list.main - agents.list.Dao Fix: Use restrictive profiles (`minimal`/`coding`) or explicit tool allowlists that exclude plugin tools for agents handling untrusted input. WARN Telegram DMs share the main session Multiple DM senders currently share the main session, which can leak context across users. Fix: Run: openclaw config set session.dmScope "per-channel-peer" (or "per-account-channel-peer" for multi-account channels) to isolate DM sessions per sender. Full report: openclaw security audit Deep probe: openclaw security audit --deep Channels ┌─────────────────┬─────────┬────────┬────────────────────────────────────────────────────────────────────────────────┐ │ Channel │ Enabled │ State │ Detail │ ├─────────────────┼─────────┼────────┼────────────────────────────────────────────────────────────────────────────────┤ │ Telegram │ ON │ OK │ token config (8412…TvvE · len 46) · accounts 1/1 │ │ Microsoft Teams │ ON │ OK │ configured │ └─────────────────┴─────────┴────────┴────────────────────────────────────────────────────────────────────────────────┘ Sessions ┌──────────────────────────────────────────────────┬────────┬──────────┬──────────────────────────┬───────────────────┐ │ Key │ Kind │ Age │ Model │ Tokens │ ├──────────────────────────────────────────────────┼────────┼──────────┼──────────────────────────┼───────────────────┤ │ agent:main:main │ direct │ just now │ claude-opus-4-6-thinking │ unknown/200k (?%) │ │ agent:main:msteams:group:19:7ef… │ group │ just now │ gpt-5.3-codex │ 171k/272k (63%) │ │ agent:dao:main │ direct │ 1m ago │ claude-opus-4-6-thinking │ unknown/200k (?%) │ │ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 2m ago │ gpt-5.3-codex │ 13k/272k (5%) │ │ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 2m ago │ gpt-5.3-codex │ 13k/272k (5%) │ │ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 3h ago │ gpt-5.3-codex │ 13k/272k (5%) │ │ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 4h ago │ gpt-5.3-codex │ 14k/272k (5%) │ │ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 4h ago │ gpt-5.3-codex │ 14k/272k (5%) │ │ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 4h ago │ gpt-5.3-codex │ 14k/272k (5%) │ │ agent:dao:cron:f92ee46a-f151-4e… │ direct │ 5h ago │ gpt-5.3-codex │ 17k/272k (6%) │ └──────────────────────────────────────────────────┴────────┴──────────┴──────────────────────────┴───────────────────┘ Health ┌─────────────────┬───────────┬───────────────────────────────────────────────────────────────────────────────────────┐ │ Item │ Status │ Detail │ ├─────────────────┼───────────┼───────────────────────────────────────────────────────────────────────────────────────┤ │ Gateway │ reachable │ 420ms │ │ Telegram │ OK │ ok (@assistaobot:default:219ms) │ │ Microsoft Teams │ OK │ ok (default:default:ok) │ └─────────────────┴───────────┴───────────────────────────────────────────────────────────────────────────────────────┘ FAQ: https://docs.openclaw.ai/faq Troubleshooting: https://docs.openclaw.ai/troubleshooting Next steps: Need to share? openclaw status --all Need to debug live? openclaw logs --follow Need to test channels? openclaw status --deep shows Microsoft Teams: OK and no missing-module error. <!-- greptile_comment --> <h3>Greptile Summary</h3> Fixes a runtime `Cannot find module '@microsoft/agents-hosting'` crash that occurs when the bundled msteams extension is used via global npm or Homebrew installs. The root cause is that bundled extensions ship as files inside the main `openclaw` package (via the `files: ["extensions/"]` entry), but their `node_modules` are not included — so Node's module resolution can't find `@microsoft/agents-hosting*` unless those packages are also declared in the root `package.json`. - Adds `@microsoft/agents-hosting`, `@microsoft/agents-hosting-express`, and `@microsoft/agents-hosting-extensions-teams` (`^1.2.3`) to root `dependencies`, matching the versions already declared in `extensions/msteams/package.json` - This intentionally diverges from the AGENTS.md guideline ("keep plugin-only deps in the extension `package.json`") as a pragmatic fix for the bundled install path — the PR description notes a follow-up to improve how bundled extensions are packaged - The `pnpm-lock.yaml` is not updated in this PR; a `pnpm install` will be needed to regenerate it <h3>Confidence Score: 4/5</h3> - This PR is safe to merge — it only adds dependency declarations with no runtime code changes. - The change is minimal and well-scoped: three new dependency entries in root package.json that mirror existing declarations in the msteams extension. No runtime behavior changes. The only concern is the missing pnpm-lock.yaml update, which is a minor process issue rather than a correctness problem. The version ranges are consistent between root and extension. - No files require special attention. The `pnpm-lock.yaml` will need to be regenerated after merge. _{Last reviewed commit: 3ecaae4} <!-- greptile_other_comments_section --> _{(2/5) Greptile learns from your feedback when you react with thumbs up/down!} **Context used:** - Context from `dashboard` - CLAUDE.md ([source](https://app.greptile.com/review/custom-context?memory=fd949e91-5c3a-4ab5-90a1-cbe184fd6ce8)) <!-- /greptile_comment -->