feat(msteams): add MS Teams provider skeleton

- Add Microsoft 365 Agents SDK packages (@microsoft/agents-hosting,
  @microsoft/agents-hosting-express, @microsoft/agents-hosting-extensions-teams)
- Add MSTeamsConfig type and zod schema
- Create src/msteams/ provider with monitor, token, send, probe
- Wire provider into gateway (server-providers.ts, server.ts)
- Add msteams to all provider type unions (hooks, queue, cron, etc.)
- Update implementation guide with new SDK and progress

src/config/types.ts

@@ -87,6 +87,7 @@ export type AgentElevatedAllowFromConfig = {
   slack?: Array<string | number>;
   signal?: Array<string | number>;
   imessage?: Array<string | number>;
+  msteams?: Array<string | number>;
   webchat?: Array<string | number>;
 };
 
@@ -214,7 +215,8 @@ export type HookMappingConfig = {
     | "discord"
     | "slack"
     | "signal"
-    | "imessage";
+    | "imessage"
+    | "msteams";
   to?: string;
   /** Override model for this hook (provider/model or alias). */
   model?: string;
@@ -569,6 +571,64 @@ export type SignalConfig = {
   accounts?: Record<string, SignalAccountConfig>;
 } & SignalAccountConfig;
 
+export type MSTeamsWebhookConfig = {
+  /** Port for the webhook server. Default: 3978. */
+  port?: number;
+  /** Path for the messages endpoint. Default: /api/messages. */
+  path?: string;
+};
+
+/** Reply style for MS Teams messages. */
+export type MSTeamsReplyStyle = "thread" | "top-level";
+
+/** Channel-level config for MS Teams. */
+export type MSTeamsChannelConfig = {
+  /** Require @mention to respond. Default: true. */
+  requireMention?: boolean;
+  /** Reply style: "thread" replies to the message, "top-level" posts a new message. */
+  replyStyle?: MSTeamsReplyStyle;
+};
+
+/** Team-level config for MS Teams. */
+export type MSTeamsTeamConfig = {
+  /** Default requireMention for channels in this team. */
+  requireMention?: boolean;
+  /** Default reply style for channels in this team. */
+  replyStyle?: MSTeamsReplyStyle;
+  /** Per-channel overrides. Key is conversation ID (e.g., "19:...@thread.tacv2"). */
+  channels?: Record<string, MSTeamsChannelConfig>;
+};
+
+export type MSTeamsConfig = {
+  /** If false, do not start the MS Teams provider. Default: true. */
+  enabled?: boolean;
+  /** Azure Bot App ID (from Azure Bot registration). */
+  appId?: string;
+  /** Azure Bot App Password / Client Secret. */
+  appPassword?: string;
+  /** Azure AD Tenant ID (for single-tenant bots). */
+  tenantId?: string;
+  /** Webhook server configuration. */
+  webhook?: MSTeamsWebhookConfig;
+  /** Direct message access policy (default: pairing). */
+  dmPolicy?: DmPolicy;
+  /** Allowlist for DM senders (AAD object IDs or UPNs). */
+  allowFrom?: Array<string>;
+  /** Outbound text chunk size (chars). Default: 4000. */
+  textChunkLimit?: number;
+  /**
+   * Allowed host suffixes for inbound attachment downloads.
+   * Use ["*"] to allow any host (not recommended).
+   */
+  mediaAllowHosts?: Array<string>;
+  /** Default: require @mention to respond in channels/groups. */
+  requireMention?: boolean;
+  /** Default reply style: "thread" replies to the message, "top-level" posts a new message. */
+  replyStyle?: MSTeamsReplyStyle;
+  /** Per-team config. Key is team ID (from the /team/ URL path segment). */
+  teams?: Record<string, MSTeamsTeamConfig>;
+};
+
 export type IMessageAccountConfig = {
   /** Optional display name for this account (used in CLI/UI lists). */
   name?: string;
@@ -631,6 +691,7 @@ export type QueueModeByProvider = {
   slack?: QueueMode;
   signal?: QueueMode;
   imessage?: QueueMode;
+  msteams?: QueueMode;
   webchat?: QueueMode;
 };
 
@@ -875,13 +936,6 @@ export type GatewayTailscaleConfig = {
 export type GatewayRemoteConfig = {
   /** Remote Gateway WebSocket URL (ws:// or wss://). */
   url?: string;
-  /**
-   * Remote gateway over SSH, forwarding the gateway port to localhost.
-   * Format: "user@host" or "user@host:port" (port defaults to 22).
-   */
-  sshTarget?: string;
-  /** Optional SSH identity file path. */
-  sshIdentity?: string;
   /** Token for remote auth (when the gateway requires token auth). */
   token?: string;
   /** Password for remote auth (when the gateway requires password auth). */
@@ -1126,7 +1180,7 @@ export type ClawdbotConfig = {
       every?: string;
       /** Heartbeat model override (provider/model). */
       model?: string;
-      /** Delivery target (last|whatsapp|telegram|discord|signal|imessage|none). */
+      /** Delivery target (last|whatsapp|telegram|discord|signal|imessage|msteams|none). */
       target?:
         | "last"
         | "whatsapp"
@@ -1135,6 +1189,7 @@ export type ClawdbotConfig = {
         | "slack"
         | "signal"
         | "imessage"
+        | "msteams"
         | "none";
       /** Optional delivery override (E.164 for WhatsApp, chat id for Telegram). */
       to?: string;
@@ -1225,6 +1280,7 @@ export type ClawdbotConfig = {
   slack?: SlackConfig;
   signal?: SignalConfig;
   imessage?: IMessageConfig;
+  msteams?: MSTeamsConfig;
   cron?: CronConfig;
   hooks?: HooksConfig;
   bridge?: BridgeConfig;

src/config/zod-schema.ts

@@ -109,6 +109,8 @@ const requireOpenAllowFrom = (params: {
   });
 };
 
+const MSTeamsReplyStyleSchema = z.enum(["thread", "top-level"]);
+
 const RetryConfigSchema = z
   .object({
     attempts: z.number().int().min(1).optional(),
@@ -126,6 +128,7 @@ const QueueModeBySurfaceSchema = z
     slack: QueueModeSchema.optional(),
     signal: QueueModeSchema.optional(),
     imessage: QueueModeSchema.optional(),
+    msteams: QueueModeSchema.optional(),
     webchat: QueueModeSchema.optional(),
   })
   .optional();
@@ -455,6 +458,48 @@ const IMessageConfigSchema = IMessageAccountSchemaBase.extend({
   });
 });
 
+const MSTeamsChannelSchema = z.object({
+  requireMention: z.boolean().optional(),
+  replyStyle: MSTeamsReplyStyleSchema.optional(),
+});
+
+const MSTeamsTeamSchema = z.object({
+  requireMention: z.boolean().optional(),
+  replyStyle: MSTeamsReplyStyleSchema.optional(),
+  channels: z.record(z.string(), MSTeamsChannelSchema.optional()).optional(),
+});
+
+const MSTeamsConfigSchema = z
+  .object({
+    enabled: z.boolean().optional(),
+    appId: z.string().optional(),
+    appPassword: z.string().optional(),
+    tenantId: z.string().optional(),
+    webhook: z
+      .object({
+        port: z.number().int().positive().optional(),
+        path: z.string().optional(),
+      })
+      .optional(),
+    dmPolicy: DmPolicySchema.optional().default("pairing"),
+    allowFrom: z.array(z.string()).optional(),
+    textChunkLimit: z.number().int().positive().optional(),
+    mediaAllowHosts: z.array(z.string()).optional(),
+    requireMention: z.boolean().optional(),
+    replyStyle: MSTeamsReplyStyleSchema.optional(),
+    teams: z.record(z.string(), MSTeamsTeamSchema.optional()).optional(),
+  })
+  .superRefine((value, ctx) => {
+    requireOpenAllowFrom({
+      policy: value.dmPolicy,
+      allowFrom: value.allowFrom,
+      ctx,
+      path: ["allowFrom"],
+      message:
+        'msteams.dmPolicy="open" requires msteams.allowFrom to include "*"',
+    });
+  });
+
 const SessionSchema = z
   .object({
     scope: z.union([z.literal("per-sender"), z.literal("global")]).optional(),
@@ -742,6 +787,7 @@ const HookMappingSchema = z
         z.literal("slack"),
         z.literal("signal"),
         z.literal("imessage"),
+        z.literal("msteams"),
       ])
       .optional(),
     to: z.string().optional(),
@@ -1049,6 +1095,7 @@ export const ClawdbotSchema = z.object({
               slack: z.array(z.union([z.string(), z.number()])).optional(),
               signal: z.array(z.union([z.string(), z.number()])).optional(),
               imessage: z.array(z.union([z.string(), z.number()])).optional(),
+              msteams: z.array(z.union([z.string(), z.number()])).optional(),
               webchat: z.array(z.union([z.string(), z.number()])).optional(),
             })
             .optional(),
@@ -1205,6 +1252,7 @@ export const ClawdbotSchema = z.object({
   slack: SlackConfigSchema.optional(),
   signal: SignalConfigSchema.optional(),
   imessage: IMessageConfigSchema.optional(),
+  msteams: MSTeamsConfigSchema.optional(),
   bridge: z
     .object({
       enabled: z.boolean().optional(),
@@ -1283,8 +1331,6 @@ export const ClawdbotSchema = z.object({
       remote: z
         .object({
           url: z.string().optional(),
-          sshTarget: z.string().optional(),
-          sshIdentity: z.string().optional(),
           token: z.string().optional(),
           password: z.string().optional(),
         })