I enabled just to check it out, noticed my teams messages stopped working. I was working from my phone so haven't read much of the code myself.
Teams message came back with:
⚠️ Access Denied
OpenAPPA requires an authenticated Archestra caller
I asked Claude to clone the repo and trace back that message and didn't realise it was on opus so got some profound ted talk back. I haven't checked any of this is correct yet, as I'm on my phone
With ARCHESTRAOPENAPPAENABLED=true, ChatOps turns fail with a 401 from sessionFromHeaders() in openappa/service.ts, because llm-client.ts adds X-Appa-Session-ID but llm-proxy-handler.ts only resolves a loopback caller for sources in APPACHATSOURCES, and chatops:ms-teams isn't one. Adding it to that list won't work on its own, because the ConversationModel.getAgentIdForUser check would then 403 on the buildChatOpsSessionId session IDs, so ChatOps needs its own trusted-caller branch using the Teams-resolved user ID.