HKUDS/nanobot · error · RuntimeError

MSTeams conversation ref has untrusted service_url for…

Error message

MSTeams conversation ref has untrusted service_url for chat_id={msg.chat_id}

What it means

Raised in MSTeams send() when a stored conversation reference's service_url does not match the trusted service URL for the chat, indicating the ref was captured from a different (potentially spoofed) Bot Framework endpoint. It fires as a safety guard before outbound HTTP calls so replies cannot be redirected to an attacker-controlled server.

Solutions

1. Remove the stored conversation ref so the next inbound activity re-establishes a trusted ref
2. Verify the bot's Microsoft App ID and channel configuration match the tenant the messages come from
3. Check that the inbound webhook endpoint is only reachable via the official Bot Framework service URLs

When it happens

Trigger: Thrown at nanobot/channels/msteams/runtime.py:261 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of HKUDS/nanobot@42f37dc4c0 (2026-08-26). Data as JSON: /api/errors/901541e2cffc73a7. Report an issue: GitHub.

Appendix: source

Thrown at nanobot/channels/msteams/runtime.py:261

            self._server = None
        if self._server_thread and self._server_thread.is_alive():
            self._server_thread.join(timeout=2)
        self._server_thread = None
        if self._http:
            await self._http.aclose()
            self._http = None

    async def send(self, msg: OutboundMessage) -> None:
        """Send a plain text reply into an existing Teams conversation."""
        if not self._http:
            raise RuntimeError("MSTeams HTTP client not initialized")

        ref = self._conversation_refs.get(str(msg.chat_id))
        if not ref:
            raise RuntimeError(f"MSTeams conversation ref not found for chat_id={msg.chat_id}")

        if not self._is_trusted_service_url(ref.service_url):
            raise RuntimeError(
                f"MSTeams conversation ref has untrusted service_url for chat_id={msg.chat_id}"
            )

        token = await self._get_access_token()
        base_url = f"{ref.service_url.rstrip('/')}/v3/conversations/{ref.conversation_id}/activities"
        use_thread_reply = self.config.reply_in_thread and bool(ref.activity_id)
        headers = {
            "Authorization": f"Bearer {token}",
            "Content-Type": "application/json",
        }
        payload = {
            "type": "message",
            "text": msg.content or " ",
        }
        if use_thread_reply:
            payload["replyToId"] = cast(str, ref.activity_id)

        try:

View on GitHub (pinned to 42f37dc4c0)