Repository navigation
Conversation
.claude/ctx-guard.json gives the main role context notes at 300k, 400k and 500k (then every 50k), the solo preset's usage triggers, and an automatic clear-and-resume restart above 90k. .gitignore keeps the personal ctx-guard.local.json and the .ctx-guard/ state folder out.
Graph refuses GET /me/joinedTeams to Group.Read.All and names Team.ReadBasic.All, TeamSettings.Read.All, User.Read.All and Directory.Read.All (or their ReadWrite forms). `teams list` declared Team.ReadBasic.All|Group.Read.All, and a TEAM given by display name was resolved through that path under the same gate, so the default sign-in passed the local check and then got error[Forbidden] from Graph. `teams list` now declares the joinedTeams read scopes, and every teams verb gates them again before it resolves a TEAM by display name, so the command stops with MISSING_SCOPE and the `login --scopes extended` hint before any request. A team given by GUID or `id:` keeps the verb's own gate, which Group.Read.All still satisfies. The scope implication table maps User.ReadWrite.All, Directory.ReadWrite.All and TeamSettings.ReadWrite.All to their read forms, so those tokens pass while `teams list` declares only read scopes and stays read-only to MCP. SKILL.md lists `teams list` and team-by-name among the verbs that need `extended`, and its teams examples and channel-post recipe pass a team GUID; the reference marks the by-name verbs "Beyond default".
- `teams list`, and any `teams` verb given a TEAM by display name, check for Team.ReadBasic.All (or another scope Graph accepts for /me/joinedTeams) before any request and stop with MISSING_SCOPE and the `login --scopes extended` hint; a team given by GUID still works with Group.Read.All - the scope check counts User.ReadWrite.All, Directory.ReadWrite.All and TeamSettings.ReadWrite.All as holding their .Read.All forms
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
teams list, and anyteamsverb given aTEAMby display name, check forTeam.ReadBasic.All(or another scope Graph accepts for/me/joinedTeams) before sending arequest, and stop with
error[MISSING_SCOPE]and thelogin --scopes extendedhint. They used toaccept
Group.Read.All, which thedefaultsign-in holds, and then fail with Graph'serror[Forbidden]. A team given by id (GUID) still works withGroup.Read.All. The skill'schannel-post recipe and teams examples pass the team id, which the user copies from Teams'
Get link to team (
groupId).User.ReadWrite.All,Directory.ReadWrite.AllandTeamSettings.ReadWrite.Allas holding their.Read.Allforms.