Add Microsoft 365 actions, approvals, and delegated workflow execution

[Paul Lizer (paullizer)]

Summary

• Add separate Microsoft 365 Calendar, Email, OneDrive, and SharePoint Online (SPO) actions with delegated access, live file RAG, and cloud-aware Copilot Retrieval/Graph selection. No PAYG, workspace file sync, or Azure AI Search ingestion is introduced.
• Unify source-sharing, extended-analysis, and workflow Run as decisions across chat, Profile, Approvals, and notifications. Sharing covers retained evidence as well as answers; published copies remain governed by conversation access.
• Add durable conversation evidence, staged analysis, approval-aware continuations, encrypted workflow connections, and claimed mail/calendar delivery. Revalidate capabilities and identities, preserve completed work, and prevent replay of uncertain side effects.
• Preserve existing combined Graph action editing while blocking new creation, cloning, restoration, and settings-based resurrection. Update documentation and regressions; application version is 0.261.034.

Interactive reconnect (f5f25690): adds Profile > Settings > Microsoft 365 chat connection > Reconnect Microsoft 365 for chat, even when credentials already exist or no request is paused. Fresh state/nonce/PKCE sign-in replaces the cache only after same-account verification; failures preserve the old cache. Profile reconnect does not replay past requests or change workflow connections or sharing approvals. Graph bearer-token HTTP 401 responses now preserve scopes/source for the existing chat sign-in continuation. Policy denial, throttling, service/configuration failures, and expired temporary download links remain distinct.

Important unresolved retrieval configuration: read-only investigation of the latest screenshot identified model_context_unavailable, not expired Microsoft credentials. The selected gpt-5.6-terra catalog record has no declared context/output token limits. Reconnecting does not fix that separate model-budget issue; this change neither invents limits nor bypasses the safety bound. Details are in M365_CHAT_RECONNECT_RECOVERY_FIX.md.

Consent callback (98c4b0ab): accepts additional previously consented permissions in successful token responses while requiring every requested grant. The outbound scope allowlist, configured cloud matching, and narrow workflow authorization remain unchanged.

Connection onboarding (26e44a23): binds selected actions before kernel loading, offers Connect in chat before model execution when delegated access is missing, and resumes the original conversation. Reuses /getAToken, fixes HTTPS callbacks and exact stale-CSRF recovery, and uses source-level consent bundles with Commercial/Government/custom-cloud support.

Streaming and CodeQL (bdb668af, 1883af6e, c23e32c1): fixes unsupported Cosmos replacement arguments and async streaming context lifetime; removes public workflow diagnostics, protects historical projections, clarifies control flow, and removes the execution/connection import cycle. Four intentional Protocol/facade notes are documented and their review threads were answered/resolved without global suppression.

Target: Development in microsoft/simplechat.

Setup: interactive chat and Profile chat reconnect use /getAToken and the server-side login session, without Key Vault or a saved workflow connection. Unattended workflows separately require /api/m365/connections/callback, explicit Run as consent, and a dedicated Key Vault encryption key referenced by M365_WORKFLOW_TOKEN_KEY_SECRET_NAME. Bootstrap provisions m365_connections and m365_execution_runs with /user_id partitions. See docs/explanation/features/MICROSOFT_365_ACTIONS.md.

Deployment: 0.261.034 is committed and pushed for user-managed deployment. This session has not rebuilt/restarted the test app or changed tenant permissions/Key Vault credentials. The inspected deployment's workflow-only callback and encryption-key reference still require administrator setup for unattended workflows.

Linked issue

Refs #1493. Related sync/external-tab work in #954 and #956 remains separate.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Compatibility: no new combined Graph actions; workflows require an explicitly selected, consenting Run as account. Selecting Calendar or Email requests its supported operation permission bundle, shown by Microsoft before consent; disabled action capabilities and outgoing-delivery reviews still apply. Existing narrower connections are not silently upgraded.

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application advanced from 0.261.028 through the feature/remediation fixes to 0.261.034. Latest patch adds interactive reconnect and Graph authentication recovery. No deployer files changed.

Testing / validation

• Reconnect backend integration: 580 passed, 157 subtests passed. Focused optimized run: 201 passed, 107 subtests passed. Final entrypoint rerun: 78 passed, 107 subtests passed.
• Real-module normal/optimized web/scheduler cold imports: 13 passed. Route policies: 12 checks passed. Documentation surface/site checks: 13 checks passed; regenerated inventory remains unchanged.
• Isolated Azure Playwright-ready M365 UI suite: 98 passed in local Chromium, covering reconnect with/without cached credentials, source selection, independent workflow controls, callback/query cleanup without replay, errors, and Commercial/Government/custom authorities. JavaScript syntax and whitespace checks pass.
• Real MSAL tests preserve old credentials on failed/wrong-account reconnect and publish only verified caches. Real Semantic Kernel tests preserve the exact sign-in wait/scopes and do not replay completed tools. Provider tests distinguish Graph 401 from 403/429/503, model errors, and expired download URLs.
• Earlier consent-scope qualification: 268 passed, 149 subtests passed; optimized 86 passed, 130 subtests passed. Earlier onboarding: 559 passed, 114 subtests passed, plus 62 UI tests. Earlier streaming/Cosmos: 571 passed, 96 subtests passed, using real Cosmos SDK/RequestsTransport and Semantic Kernel streaming with external I/O isolated.
• Earlier CodeQL analysis on c23e32c1 reduced 31 PR findings to four intentional notes. Workflows on bdb668af and 26e44a23 also passed. These are historical results, not a claim about CI on the latest head.

Live evidence: Azure telemetry and the existing shared browser reproduced the earlier missing-action/callback issues. The consent incident showed successful Microsoft token exchange followed by local scope rejection. For the latest screenshot, extracted diagnostic codes were model_context_unavailable and earlier invalid_query; a correlated Graph search returned 200. No live token bodies or document contents were retrieved for diagnosis, and temporary log downloads were removed.

Known pre-existing tests: three unchanged grounding tests have stale call-count/incomplete AST fixtures against original head b8a75418; an unchanged chat-reattach test asserts historical version 0.239.191 exactly. They were not edited to conceal failures.

Not performed: live end-to-end qualification of the newly deployed 0.261.034 reconnect flow or live Government/custom-cloud, Copilot, and Key Vault qualification. The user handles deployment before live retesting. Reconnect does not resolve the separate missing model-budget configuration.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Feature, source-action, Profile, workflow, admin, and chat-control documentation is updated. Versioned fixes cover CodeQL, Cosmos/streaming, onboarding, consent-scope responses, and M365_CHAT_RECONNECT_RECOVERY_FIX.md. Release notes remain unchanged per the prior request; a Latest Feature card is not included.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) and Blueprint/user guards
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser runtime assets are local; no CDN JavaScript
• No credentials, secrets, or local artifacts are committed
• Interactive consent binds current user, tenant, state, nonce, PKCE, sources, and a server-owned callback
• Reconnect status reveals no cache/token material and is not presented as remote health
• Profile repair never replays a request or changes workflow grants; extra token scopes do not expand application authorization

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.