feat: Microsoft Teams ingestion (delegated Graph sync)

[njt]

What

Sync your own Microsoft Teams 1:1/group/meeting chats and channel messages into msgvault via delegated Microsoft Graph, searchable alongside mail through the existing TUI / FTS / Parquet analytics.

Highlights

• New add-teams (delegated Graph OAuth) and sync-teams (full + incremental, with streamed per-conversation progress) commands; Teams also runs under serve scheduled syncs — and the daemon now syncs all source types on an identifier (so Teams + Outlook/IMAP on one address both run).
• Reuses the existing chat schema — no new core tables: chats → direct/group conversations, channels → channel conversations with root+reply threading, plus reactions, sender + recipient (to) + @mention rows, identity resolution (AAD object id → email dedup, unifying with mail identities), inline images downloaded to content-addressed storage, and shared-file links recorded.
• Incremental sync: chats via lastModifiedDateTime list filtering (no delegated per-chat delta endpoint exists), channels via /messages/delta; per-conversation cursors persisted in sync_runs.cursor_after, flushed after each conversation so an interrupted long backfill resumes mid-stream.
• Microsoft OAuth kept independent from the existing Outlook/IMAP manager — separate teams_<email>.json token with Graph scopes only, so IMAP and Teams can each be used alone or together.

Use

1. Register an Entra app with delegated Graph permissions (Chat.Read, ChannelMessage.Read.All, Team.ReadBasic.All, Channel.ReadBasic.All, User.Read) and grant admin consent.
2. Add to config.toml:

   [microsoft]
   client_id = "<app-client-id>"
   tenant_id = "<directory-tenant-id>"

3. msgvault add-teams you@tenant.com then msgvault sync-teams you@tenant.com (--no-channels / --limit for scoped runs). Press a inside msgvault tui to filter to the Teams account.

Notes

• Validated on a live tenant: ~313k messages spanning 2017–2026 (chats, channels, reactions, threaded replies) — confirms full-history backfill beyond Graph's 8-month delta window.
• Meeting transcripts are intentionally out of scope (separate spec; delegated transcript access is effectively organizer-only). The only remaining follow-up is preserving a departing user's shared SharePoint/OneDrive files before account removal.

🤖 Generated with Claude Code

[roborev-ci]

roborev: Review Unavailable (e58e9fc)

The review agent repeatedly failed to run (likely an agent or configuration error). roborev will try again on the next commit.

Last error: agent: claude-code failed stream: stream errors: You've hit your session limit · resets 5:50am (UTC): exit status 1

[roborev-ci]

roborev: Review Unavailable (7d3cff4)

The review agent repeatedly failed to run (likely an agent or configuration error). roborev will try again on the next commit.

Last error: agent: claude-code failed stream: stream errors: You've hit your session limit · resets 5:50am (UTC): exit status 1

[roborev-ci]

roborev: Combined Review (d4652cb)

Summary verdict: changes are close, but there is one high-severity data-loss issue and several medium-severity Teams integration correctness gaps.

High

• internal/teams/importer.go:266: If fetching replies for a channel root fails during the initial backfill or delta-token fallback, the importer only increments sum.Errors, continues, primes a new delta cursor, and later stores it. The missed historical replies will not be retried on the next sync.
  • Fix: Treat reply-fetch failures during backfill/fallback as channel failure, or avoid advancing that channel’s delta cursor until all roots and replies were fetched successfully.

Medium

• internal/teams/mapping.go:42: Inline hosted-content images are downloaded as attachment rows, but has_attachments and attachment_count only count Graph attachments and recordings. Messages with only inline images will appear as having no attachments in APIs/search/UI.

  • Fix: Count hosted-content URLs before UpsertMessage, or update the message attachment fields after successful inline downloads/backfill.

• internal/teams/importer.go:454: Mention rows are only replaced when the current Graph message has at least one resolvable mention. If a message is edited to remove mentions, or a --full repair re-imports it with no mentions, stale recipient_type='mention' rows remain.

  • Fix: Always call ReplaceMessageRecipients(messageID, "mention", mentionIDs, mentionNames) after processing the current mentions, even when the resulting slice is empty.

• cmd/msgvault/cmd/remove_account.go:155: remove-account has no sourceTypeTeams credential cleanup case, so deleting a Teams account removes database rows but leaves the teams_<email>.json Graph OAuth token on disk.

  • Fix: Add a Teams case that uses microsoft.NewGraphManager(...).DeleteToken(source.Identifier).

• cmd/msgvault/cmd/serve.go:72: serve still requires Google [oauth] config before starting. A Teams-only setup with [microsoft] client_id and a Teams token cannot run scheduled Teams syncs through the daemon.

  • Fix: Defer Google OAuth validation to Gmail sync paths, or allow startup when Microsoft OAuth is configured and scheduled sources are Teams-only.

---

Panel: ci_default_security | Synthesis: codex, 16s | Members: codex_default (codex/default, done, 7m17s), codex_security (codex/security, done, 5m24s) | Total: 12m57s

[njt]

Two unrelated bug fixes that surfaced while building this were split out into their own PRs to keep this one scoped to Teams ingestion:

• fix(fbmessenger): don't collapse multiple attachments to one row #406 — fbmessenger: multiple attachments on one message collapsing to a single row (found via an audit of UpsertAttachment's hashless-dedup path, which this PR's Teams attachment handling also exercises).
• fix(search): empty text/subject terms must not match every message #407 — search: empty text/subject: terms matching every message (found via a pre-existing failing store test while validating this work).

Neither depends on this PR; both branch off current main.

[roborev-ci]

roborev: Combined Review (13c4591)

High-level verdict: changes need fixes before merge due to one high-risk Teams backfill data-loss path and several medium issues around auth cleanup, startup validation, embeddings, and stale child data.

High

• internal/teams/importer.go:270
  A channel backfill can fail to fetch replies for a root message, count the error, and still prime/save the channel delta cursor later. Older replies missed during that first backfill can then be skipped permanently because future runs resume from the delta link instead of retrying the full replies walk.
  Fix: Treat reply-fetch failures during full channel backfill as channel-incomplete: do not save the channel delta/checkpoint for that channel, or return an error so the next run retries the full roots+replies pass.

Medium

• cmd/msgvault/cmd/serve.go:72
serve still requires Google OAuth config via cfg.OAuth.HasAnyConfig(). A Teams-only setup with only [microsoft].client_id configured cannot start the daemon, even though this change adds scheduled Teams sync support.
  Fix: Allow the daemon to start when either Google OAuth or Microsoft Graph OAuth is configured, e.g. include cfg.Microsoft.ClientID != "" in the validation.

• cmd/msgvault/cmd/remove_account.go:155
  Removing a Teams source does not remove the new teams_<email>.json Graph token. The database source is deleted, but the credential remains and can silently re-authorize a future Teams sync. This also leaves a still-valid Graph refresh token behind after an operator believes the account was scrubbed.
  Fix: Add a sourceTypeTeams case that calls microsoft.NewGraphManager(...).DeleteToken(source.Identifier), and add a regression test confirming remove-account --type teams deletes teams_<email>.json.

• cmd/msgvault/cmd/serve.go:677
  Teams sync ignores vectorFeatures, and sync-teams does not set up vector enqueueing either. New Teams messages are written to the store but never added to pending_embeddings, so semantic/vector search misses them until a full embedding rebuild.
  Fix: Add optional embedding enqueue support to the Teams importer, return/collect persisted message IDs, and wire it from both sync-teams and scheduled Teams sync.

• internal/teams/importer.go:458
  Re-imported Teams messages do not clear child metadata when Graph returns an empty collection. Mentions are only replaced when len(gm.Mentions) > 0, and reactions/attachments are append-only, so edits that remove mentions/reactions/attachments leave stale rows.
  Fix: Use replace/delete-then-insert semantics for Teams-managed child collections, including calling ReplaceMessageRecipients with empty slices for mentions and adding equivalent replacement paths for reactions and attachments.

---

Panel: ci_default_security | Synthesis: codex, 14s | Members: codex_default (codex/default, done, 8m21s), codex_security (codex/security, done, 5m45s) | Total: 14m20s

[wesm]

looking at this