Add Microsoft Teams integration

[daltoniam]

Summary

• Adds a full Microsoft Teams adapter (integrations/teams/) implementing the mcp.Integration interface against the Microsoft Graph API.
• 26 tools spanning auth/tenant management, chats, joined teams + channels, users, and presence — multi-tenant token store with proactive + 401-triggered refresh.
• Uses Microsoft device-code OAuth against the Azure CLI public client (no client secret required for personal/dev use); persists tokens to ~/.teams-mcp-tokens.json.

Test plan

• go test ./integrations/teams/... passes (29.9% coverage, 30+ unit tests)
• go tool golangci-lint run ./integrations/teams/... clean
• TestDispatchMap_AllToolsCovered + TestDispatchMap_NoOrphanHandlers parity tests
• TestFieldCompactionSpecs_* parity tests
• TestNewArgs_ErrCheckParity covers all new handlers automatically
• make ci passes for all packages except browser.TestPage_Evaluate (pre-existing failure on main, unrelated to this change)
• Manual: teams_login → device-code flow → teams_list_chats end-to-end against a real tenant

💘 Generated with Crush

[acmacalister]

Solid implementation — the multi-tenant token store, proactive refresh, and 401-triggered retry are all handled cleanly. Tests are thorough and the dispatch/compaction parity tests are all present. Two things inline.

[acmacalister]

Solid integration — clean architecture, good test coverage, proactive token refresh, proper resource limits everywhere. Two concurrency nits and one consistency note inline.

[acmacalister]

Solid adapter — the multi-tenant token store, proactive refresh, and device-code flow are well implemented. Three things worth a look inline.

[acmacalister]

Solid integration — the multi-tenant token store, proactive refresh, and device-code flow are all well-structured. Two small test hygiene items inline; nothing blocking.

[acmacalister]

Solid integration — auth infrastructure (proactive refresh, 401 retry, device-code poll with slow_down handling, atomic token file writes) is well thought out and the HTTP layer tests are thorough. All previous review comments addressed. Two small things inline.

[acmacalister]

teamsTokenStatus has non-trivial logic — it computes age_minutes, determines status ("expired" / "expiring_soon" / "healthy"), and formats expires_in — but has no unit test. A subtle bug like checking remaining <= 0 vs remaining < 0, or the 5*time.Minute threshold, would be invisible. Same gap covers teamsRefreshTokens, teamsGetMe, formatContentType, and all the chat/channel/user handlers. The HTTP layer is solid, but argument-parsing and query-construction paths are untested.

A lightweight table-driven test covering the three status branches would cost about 20 lines:

func TestTeamsTokenStatus(t *testing.T) {
    cases := []struct{
        name    string
        exp     time.Time
        want    string
    }{
        {"healthy",  time.Now().Add(10*time.Minute), "healthy"},
        {"expiring", time.Now().Add(2*time.Minute),  "expiring_soon"},
        {"expired",  time.Now().Add(-1*time.Second), "expired"},
    }
    for _, tc := range cases {
        t.Run(tc.name, func(t *testing.T) {
            ti := newTestIntegration(t, nil)
            ti.store.upsert(&tenant{TenantID: "t1", AccessToken: "a", ExpiresAt: tc.exp})
            res, err := ti.Execute(context.Background(), "teams_token_status", nil)
            require.NoError(t, err)
            assert.Contains(t, res.Data, tc.want)
        })
    }
}

[acmacalister]

The tn variable here is a snapshot read at line 304, before the HTTP round-trip. If backgroundRefresh fires concurrently during that round-trip and Microsoft rotates the refresh token, tn.RefreshToken is now stale — the refresh will fail with "invalid refresh token" even though the current token is sitting in the store. The window is narrow, but the fix is cheap:

if resp.StatusCode == http.StatusUnauthorized && canRetry {
    if fresh := t.store.get(tenantID); fresh != nil && fresh.RefreshToken != "" {
        if rerr := t.refreshTenant(ctx, fresh); rerr == nil {
            return t.graphRequestInner(ctx, tenantID, method, path, body, extraHeaders, false)
        }
    }
}