@automagik/omni 2.260914.9 → 2.260914.11

package/db/drizzle/0069_automation_allow_instance_senders.sql

@@ -0,0 +1,17 @@
+-- Per-automation loop-guard opt-in (issue #1148).
+--
+-- `key.fromMe` is per-observer: with two instances in one WhatsApp group the
+-- bot's own messages journal as fromMe:false on the other instance, so an
+-- automation filtering on it answers itself. Channel events now carry an
+-- observer-independent `senderInstanceId`, and the engine skips events sent
+-- by a same-tenant instance unless the automation opts in:
+--
+--   automations.allow_instance_senders   true = act on messages sent by the
+--                                        tenant's own instances. Default false.
+--
+-- Hand-written following the 0043/0044/0052 precedent (additive, idempotent).
+-- No explicit BEGIN/COMMIT — the boot migrator executes this file on a pooled
+-- postgres-js connection, which rejects raw transaction control.
+
+ALTER TABLE "automations"
+  ADD COLUMN IF NOT EXISTS "allow_instance_senders" boolean NOT NULL DEFAULT false;

package/db/drizzle/meta/_journal.json

@@ -484,6 +484,13 @@
       "when": 1786800000000,
       "tag": "0068_automation_enabled_at",
       "breakpoints": true
+    },
+    {
+      "idx": 69,
+      "version": "7",
+      "when": 1786900000000,
+      "tag": "0069_automation_allow_instance_senders",
+      "breakpoints": true
     }
   ]
 }

package/dist/index.js

@@ -41764,6 +41764,8 @@ class AutomationEngine {
     const sortedAutomations = [...matchingAutomations].sort((a, b2) => b2.priority - a.priority);
     try {
       for (const automation of sortedAutomations) {
+        if (this.isInstanceSenderLoop(automation, event))
+          continue;
         if (automation.debounce && automation.debounce.mode !== "none") {
           await this.handleDebounced(automation, event);
         } else {
@@ -41776,6 +41778,17 @@ class AutomationEngine {
       throw err2;
     }
   }
+  isInstanceSenderLoop(automation, event) {
+    const senderInstanceId = event.payload.senderInstanceId;
+    if (typeof senderInstanceId !== "string" || !senderInstanceId || automation.allowInstanceSenders)
+      return false;
+    logger4.debug("Skipping event sent by a same-tenant instance", {
+      automationId: automation.id,
+      eventId: event.id,
+      senderInstanceId
+    });
+    return true;
+  }
   resolveDebounceKey(automation, event, instanceId) {
     const payload = event.payload;
     const template = automation.debounce?.key;
@@ -83210,6 +83223,7 @@ var init_schema2 = __esm(() => {
     enabled: boolean2("enabled").notNull().default(true),
     priority: integer("priority").notNull().default(0),
     transactionalEmissions: boolean2("transactional_emissions").notNull().default(false),
+    allowInstanceSenders: boolean2("allow_instance_senders").notNull().default(false),
     maxConcurrency: integer("max_concurrency"),
     concurrencyKey: text("concurrency_key"),
     enabledAt: timestamp("enabled_at", { withTimezone: true }),
@@ -137252,7 +137266,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260914.9",
+  version: "2.260914.11",
   repository: {
     type: "git",
     url: "git+https://github.com/automagik-dev/omni.git",

package/dist/server/index.js

@@ -38668,6 +38668,8 @@ class AutomationEngine {
     const sortedAutomations = [...matchingAutomations].sort((a, b2) => b2.priority - a.priority);
     try {
       for (const automation of sortedAutomations) {
+        if (this.isInstanceSenderLoop(automation, event))
+          continue;
         if (automation.debounce && automation.debounce.mode !== "none") {
           await this.handleDebounced(automation, event);
         } else {
@@ -38680,6 +38682,17 @@ class AutomationEngine {
       throw err2;
     }
   }
+  isInstanceSenderLoop(automation, event) {
+    const senderInstanceId = event.payload.senderInstanceId;
+    if (typeof senderInstanceId !== "string" || !senderInstanceId || automation.allowInstanceSenders)
+      return false;
+    logger4.debug("Skipping event sent by a same-tenant instance", {
+      automationId: automation.id,
+      eventId: event.id,
+      senderInstanceId
+    });
+    return true;
+  }
   resolveDebounceKey(automation, event, instanceId) {
     const payload = event.payload;
     const template = automation.debounce?.key;
@@ -173697,6 +173710,7 @@ var init_schema2 = __esm(() => {
     enabled: boolean2("enabled").notNull().default(true),
     priority: integer("priority").notNull().default(0),
     transactionalEmissions: boolean2("transactional_emissions").notNull().default(false),
+    allowInstanceSenders: boolean2("allow_instance_senders").notNull().default(false),
     maxConcurrency: integer("max_concurrency"),
     concurrencyKey: text("concurrency_key"),
     enabledAt: timestamp("enabled_at", { withTimezone: true }),
@@ -196158,7 +196172,7 @@ function shouldIgnoreSpansForIncomingRequest(request, {
   ignoreStaticAssets,
   ignoreIncomingRequests
 }) {
-  if (import_core68.isTracingSuppressed(import_api7.context.active())) {
+  if (import_core69.isTracingSuppressed(import_api7.context.active())) {
     return true;
   }
   const urlPath = request.url;
@@ -196210,7 +196224,7 @@ function getIncomingRequestAttributesOnResponse(request, response) {
     [import_semantic_conventions.SEMATTRS_HTTP_STATUS_CODE]: statusCode,
     "http.status_text": statusMessage?.toUpperCase()
   };
-  const rpcMetadata = import_core68.getRPCMetadata(import_api7.context.active());
+  const rpcMetadata = import_core69.getRPCMetadata(import_api7.context.active());
   if (socket) {
     const { localAddress, localPort, remoteAddress, remotePort } = socket;
     newAttributes[import_semantic_conventions.SEMATTRS_NET_HOST_IP] = localAddress;
@@ -196220,7 +196234,7 @@ function getIncomingRequestAttributesOnResponse(request, response) {
   }
   newAttributes[import_semantic_conventions.SEMATTRS_HTTP_STATUS_CODE] = statusCode;
   newAttributes["http.status_text"] = (statusMessage || "").toUpperCase();
-  if (rpcMetadata?.type === import_core68.RPCType.HTTP && rpcMetadata.route !== undefined) {
+  if (rpcMetadata?.type === import_core69.RPCType.HTTP && rpcMetadata.route !== undefined) {
     const routeName = rpcMetadata.route;
     newAttributes[import_semantic_conventions.ATTR_HTTP_ROUTE] = routeName;
   }
@@ -196235,7 +196249,7 @@ function shouldFilterStatusCode(statusCode, dropForStatusCodes) {
     return statusCode >= min && statusCode <= max;
   });
 }
-var import_api7, import_core68, import_semantic_conventions, INTEGRATION_NAME8 = "Http.ServerSpans", _httpServerSpansIntegration = (options = {}) => {
+var import_api7, import_core69, import_semantic_conventions, INTEGRATION_NAME8 = "Http.ServerSpans", _httpServerSpansIntegration = (options = {}) => {
   const ignoreStaticAssets = options.ignoreStaticAssets ?? true;
   const ignoreIncomingRequests = options.ignoreIncomingRequests;
   const ignoreStatusCodes = options.ignoreStatusCodes ?? [
@@ -196300,10 +196314,10 @@ var import_api7, import_core68, import_semantic_conventions, INTEGRATION_NAME8 =
           applyCustomAttributesOnSpan?.(span, request, response);
           onSpanCreated?.(span, request, response);
           const rpcMetadata = {
-            type: import_core68.RPCType.HTTP,
+            type: import_core69.RPCType.HTTP,
             span
           };
-          return import_api7.context.with(import_core68.setRPCMetadata(import_api7.trace.setSpan(import_api7.context.active(), span), rpcMetadata), () => {
+          return import_api7.context.with(import_core69.setRPCMetadata(import_api7.trace.setSpan(import_api7.context.active(), span), rpcMetadata), () => {
             import_api7.context.bind(import_api7.context.active(), request);
             import_api7.context.bind(import_api7.context.active(), response);
             let isEnded = false;
@@ -196365,7 +196379,7 @@ var init_httpServerSpansIntegration = __esm(() => {
   init_debug_build2();
   init_httpServerIntegration();
   import_api7 = __toESM(require_src(), 1);
-  import_core68 = __toESM(require_src6(), 1);
+  import_core69 = __toESM(require_src6(), 1);
   import_semantic_conventions = __toESM(require_src5(), 1);
   httpServerSpansIntegration = _httpServerSpansIntegration;
 });
@@ -198199,13 +198213,13 @@ import { subscribe as subscribe2 } from "diagnostics_channel";
 import { errorMonitor as errorMonitor2 } from "events";
 import * as http from "http";
 import * as https from "https";
-var import_api8, import_core71, import_instrumentation, FULLY_SUPPORTS_HTTP_DIAGNOSTICS_CHANNEL, SentryHttpInstrumentation;
+var import_api8, import_core72, import_instrumentation, FULLY_SUPPORTS_HTTP_DIAGNOSTICS_CHANNEL, SentryHttpInstrumentation;
 var init_SentryHttpInstrumentation = __esm(() => {
   init_esm2();
   init_constants10();
   init_nodeVersion();
   import_api8 = __toESM(require_src(), 1);
-  import_core71 = __toESM(require_src6(), 1);
+  import_core72 = __toESM(require_src6(), 1);
   import_instrumentation = __toESM(require_src8(), 1);
   FULLY_SUPPORTS_HTTP_DIAGNOSTICS_CHANNEL = NODE_VERSION.major === 22 && NODE_VERSION.minor >= 12 || NODE_VERSION.major === 23 && NODE_VERSION.minor >= 2 || NODE_VERSION.major >= 24;
   SentryHttpInstrumentation = class SentryHttpInstrumentation extends import_instrumentation.InstrumentationBase {
@@ -198220,7 +198234,7 @@ var init_SentryHttpInstrumentation = __esm(() => {
         ...options,
         spans: options.createSpansForOutgoingRequests && (options.spans ?? true),
         ignoreOutgoingRequests(url, request) {
-          return import_core71.isTracingSuppressed(import_api8.context.active()) || !!options.ignoreOutgoingRequests?.(url, getRequestOptions(request));
+          return import_core72.isTracingSuppressed(import_api8.context.active()) || !!options.ignoreOutgoingRequests?.(url, getRequestOptions(request));
         },
         outgoingRequestHook(span, request) {
           options.outgoingRequestHook?.(span, request);
@@ -198440,13 +198454,13 @@ var init_outgoingFetchRequest = __esm(() => {
 
 // ../../node_modules/.bun/@sentry+node-core@10.52.0+2c50d7e904f6cfd7/node_modules/@sentry/node-core/build/esm/integrations/node-fetch/SentryNodeFetchInstrumentation.js
 import * as diagch from "diagnostics_channel";
-var import_api9, import_core74, import_instrumentation2, SentryNodeFetchInstrumentation;
+var import_api9, import_core75, import_instrumentation2, SentryNodeFetchInstrumentation;
 var init_SentryNodeFetchInstrumentation = __esm(() => {
   init_esm2();
   init_nodeVersion();
   init_outgoingFetchRequest();
   import_api9 = __toESM(require_src(), 1);
-  import_core74 = __toESM(require_src6(), 1);
+  import_core75 = __toESM(require_src6(), 1);
   import_instrumentation2 = __toESM(require_src8(), 1);
   SentryNodeFetchInstrumentation = class SentryNodeFetchInstrumentation extends import_instrumentation2.InstrumentationBase {
     constructor(config2 = {}) {
@@ -198517,7 +198531,7 @@ var init_SentryNodeFetchInstrumentation = __esm(() => {
       });
     }
     _shouldIgnoreOutgoingRequest(request) {
-      if (import_core74.isTracingSuppressed(import_api9.context.active())) {
+      if (import_core75.isTracingSuppressed(import_api9.context.active())) {
         return true;
       }
       const url = getAbsoluteUrl2(request.origin, request.path);
@@ -200877,7 +200891,7 @@ function makeTraceState({
   sampled
 }) {
   const dscString = dsc ? dynamicSamplingContextToSentryBaggageHeader(dsc) : undefined;
-  const traceStateBase = new import_core77.TraceState;
+  const traceStateBase = new import_core78.TraceState;
   const traceStateWithDsc = dscString ? traceStateBase.set(SENTRY_TRACE_STATE_DSC, dscString) : traceStateBase;
   return sampled === false ? traceStateWithDsc.set(SENTRY_TRACE_STATE_SAMPLED_NOT_RECORDING, "1") : traceStateWithDsc;
 }
@@ -201001,13 +201015,13 @@ function _startSpan(options, callback, autoEnd) {
   return wrapper(() => {
     const activeCtx = getContext(options.scope, options.forceTransaction);
     const missingRequiredParent = options.onlyIfParent && !import_api10.trace.getSpan(activeCtx);
-    const ctx = missingRequiredParent ? import_core77.suppressTracing(activeCtx) : activeCtx;
+    const ctx = missingRequiredParent ? import_core78.suppressTracing(activeCtx) : activeCtx;
     if (missingRequiredParent) {
       getClient()?.recordDroppedEvent("no_parent_span", "span");
     }
     const spanOptions = getSpanOptions(options);
     if (!hasSpansEnabled()) {
-      const suppressedCtx = import_core77.isTracingSuppressed(ctx) ? ctx : import_core77.suppressTracing(ctx);
+      const suppressedCtx = import_core78.isTracingSuppressed(ctx) ? ctx : import_core78.suppressTracing(ctx);
       return import_api10.context.with(suppressedCtx, () => {
         return tracer2.startActiveSpan(name, spanOptions, suppressedCtx, (span) => {
           patchSpanEnd(span);
@@ -201044,13 +201058,13 @@ function startInactiveSpan2(options) {
   return wrapper(() => {
     const activeCtx = getContext(options.scope, options.forceTransaction);
     const missingRequiredParent = options.onlyIfParent && !import_api10.trace.getSpan(activeCtx);
-    let ctx = missingRequiredParent ? import_core77.suppressTracing(activeCtx) : activeCtx;
+    let ctx = missingRequiredParent ? import_core78.suppressTracing(activeCtx) : activeCtx;
     if (missingRequiredParent) {
       getClient()?.recordDroppedEvent("no_parent_span", "span");
     }
     const spanOptions = getSpanOptions(options);
     if (!hasSpansEnabled()) {
-      ctx = import_core77.isTracingSuppressed(ctx) ? ctx : import_core77.suppressTracing(ctx);
+      ctx = import_core78.isTracingSuppressed(ctx) ? ctx : import_core78.suppressTracing(ctx);
     }
     const span = tracer2.startSpan(name, spanOptions, ctx);
     patchSpanEnd(span);
@@ -201159,7 +201173,7 @@ function getActiveSpanWrapper2(parentSpan) {
   } : (callback) => callback();
 }
 function suppressTracing2(callback) {
-  const ctx = import_core77.suppressTracing(import_api10.context.active());
+  const ctx = import_core78.suppressTracing(import_api10.context.active());
   return import_api10.context.with(ctx, callback);
 }
 function setupEventContextTrace(client) {
@@ -201846,7 +201860,7 @@ function wrapSamplingDecision({
 function getBaseTraceState(context8, spanAttributes) {
   const parentSpan = import_api10.trace.getSpan(context8);
   const parentContext = parentSpan?.spanContext();
-  let traceState = parentContext?.traceState || new import_core77.TraceState;
+  let traceState = parentContext?.traceState || new import_core78.TraceState;
   const url = spanAttributes[import_semantic_conventions2.SEMATTRS_HTTP_URL] || spanAttributes[import_semantic_conventions2.ATTR_URL_FULL];
   if (url && typeof url === "string") {
     traceState = traceState.set(SENTRY_TRACE_STATE_URL, url);
@@ -201907,12 +201921,12 @@ function getSentryResource(serviceNameFallback) {
     ...otelResourceAttrs,
     ...otelServiceName ? { [import_semantic_conventions2.ATTR_SERVICE_NAME]: otelServiceName } : {},
     [import_semantic_conventions2.ATTR_SERVICE_VERSION]: SDK_VERSION,
-    [import_semantic_conventions2.ATTR_TELEMETRY_SDK_LANGUAGE]: import_core77.SDK_INFO[import_semantic_conventions2.ATTR_TELEMETRY_SDK_LANGUAGE],
-    [import_semantic_conventions2.ATTR_TELEMETRY_SDK_NAME]: import_core77.SDK_INFO[import_semantic_conventions2.ATTR_TELEMETRY_SDK_NAME],
-    [import_semantic_conventions2.ATTR_TELEMETRY_SDK_VERSION]: import_core77.SDK_INFO[import_semantic_conventions2.ATTR_TELEMETRY_SDK_VERSION]
+    [import_semantic_conventions2.ATTR_TELEMETRY_SDK_LANGUAGE]: import_core78.SDK_INFO[import_semantic_conventions2.ATTR_TELEMETRY_SDK_LANGUAGE],
+    [import_semantic_conventions2.ATTR_TELEMETRY_SDK_NAME]: import_core78.SDK_INFO[import_semantic_conventions2.ATTR_TELEMETRY_SDK_NAME],
+    [import_semantic_conventions2.ATTR_TELEMETRY_SDK_VERSION]: import_core78.SDK_INFO[import_semantic_conventions2.ATTR_TELEMETRY_SDK_VERSION]
   });
 }
-var api, import_api10, import_semantic_conventions2, import_core77, import_sdk_trace_base, SEMANTIC_ATTRIBUTE_SENTRY_PARENT_IS_REMOTE = "sentry.parentIsRemote", SEMANTIC_ATTRIBUTE_SENTRY_GRAPHQL_OPERATION = "sentry.graphql.operation", SENTRY_TRACE_HEADER2 = "sentry-trace", SENTRY_BAGGAGE_HEADER2 = "baggage", SENTRY_TRACE_STATE_DSC = "sentry.dsc", SENTRY_TRACE_STATE_SAMPLED_NOT_RECORDING = "sentry.sampled_not_recording", SENTRY_TRACE_STATE_URL = "sentry.url", SENTRY_TRACE_STATE_SAMPLE_RAND = "sentry.sample_rand", SENTRY_TRACE_STATE_SAMPLE_RATE = "sentry.sample_rate", SENTRY_TRACE_STATE_CHILD_IGNORED = "sentry.ignored", SENTRY_TRACE_STATE_SEGMENT_IGNORED = "sentry.segment_ignored", SENTRY_SCOPES_CONTEXT_KEY, SENTRY_FORK_ISOLATION_SCOPE_CONTEXT_KEY, SENTRY_FORK_SET_SCOPE_CONTEXT_KEY, SENTRY_FORK_SET_ISOLATION_SCOPE_CONTEXT_KEY, SCOPE_CONTEXT_FIELD = "_scopeContext", setupElements, SentryPropagator, canonicalGrpcErrorCodesMap, isStatusErrorMessageValid = (message2) => {
+var api, import_api10, import_semantic_conventions2, import_core78, import_sdk_trace_base, SEMANTIC_ATTRIBUTE_SENTRY_PARENT_IS_REMOTE = "sentry.parentIsRemote", SEMANTIC_ATTRIBUTE_SENTRY_GRAPHQL_OPERATION = "sentry.graphql.operation", SENTRY_TRACE_HEADER2 = "sentry-trace", SENTRY_BAGGAGE_HEADER2 = "baggage", SENTRY_TRACE_STATE_DSC = "sentry.dsc", SENTRY_TRACE_STATE_SAMPLED_NOT_RECORDING = "sentry.sampled_not_recording", SENTRY_TRACE_STATE_URL = "sentry.url", SENTRY_TRACE_STATE_SAMPLE_RAND = "sentry.sample_rand", SENTRY_TRACE_STATE_SAMPLE_RATE = "sentry.sample_rate", SENTRY_TRACE_STATE_CHILD_IGNORED = "sentry.ignored", SENTRY_TRACE_STATE_SEGMENT_IGNORED = "sentry.segment_ignored", SENTRY_SCOPES_CONTEXT_KEY, SENTRY_FORK_ISOLATION_SCOPE_CONTEXT_KEY, SENTRY_FORK_SET_SCOPE_CONTEXT_KEY, SENTRY_FORK_SET_ISOLATION_SCOPE_CONTEXT_KEY, SCOPE_CONTEXT_FIELD = "_scopeContext", setupElements, SentryPropagator, canonicalGrpcErrorCodesMap, isStatusErrorMessageValid = (message2) => {
   return Object.values(canonicalGrpcErrorCodesMap).includes(message2);
 }, MAX_SPAN_COUNT2 = 1000, DEFAULT_TIMEOUT = 300;
 var init_resource_Bhpm2sLf = __esm(() => {
@@ -201921,21 +201935,21 @@ var init_resource_Bhpm2sLf = __esm(() => {
   api = __toESM(require_src(), 1);
   import_api10 = __toESM(require_src(), 1);
   import_semantic_conventions2 = __toESM(require_src5(), 1);
-  import_core77 = __toESM(require_src6(), 1);
+  import_core78 = __toESM(require_src6(), 1);
   import_sdk_trace_base = __toESM(require_src10(), 1);
   SENTRY_SCOPES_CONTEXT_KEY = import_api10.createContextKey("sentry_scopes");
   SENTRY_FORK_ISOLATION_SCOPE_CONTEXT_KEY = import_api10.createContextKey("sentry_fork_isolation_scope");
   SENTRY_FORK_SET_SCOPE_CONTEXT_KEY = import_api10.createContextKey("sentry_fork_set_scope");
   SENTRY_FORK_SET_ISOLATION_SCOPE_CONTEXT_KEY = import_api10.createContextKey("sentry_fork_set_isolation_scope");
   setupElements = new Set;
-  SentryPropagator = class SentryPropagator extends import_core77.W3CBaggagePropagator {
+  SentryPropagator = class SentryPropagator extends import_core78.W3CBaggagePropagator {
     constructor() {
       super();
       setIsSetup("SentryPropagator");
       this._urlMatchesTargetsMap = new LRUMap(100);
     }
     inject(context8, carrier, setter) {
-      if (import_core77.isTracingSuppressed(context8)) {
+      if (import_core78.isTracingSuppressed(context8)) {
         DEBUG_BUILD3 && debug32.log("[Tracing] Not injecting trace data for url because tracing is suppressed.");
         return;
       }
@@ -204784,12 +204798,12 @@ var init_http3 = __esm(() => {
 // ../../node_modules/.bun/@sentry+node@10.52.0+779e4caf6ead3695/node_modules/@sentry/node/build/esm/integrations/node-fetch/vendored/undici.js
 import * as diagch2 from "diagnostics_channel";
 import { URL as URL4 } from "url";
-var import_instrumentation5, import_api15, import_core106, import_semantic_conventions3, PACKAGE_NAME = "@sentry/instrumentation-undici", UndiciInstrumentation;
+var import_instrumentation5, import_api15, import_core107, import_semantic_conventions3, PACKAGE_NAME = "@sentry/instrumentation-undici", UndiciInstrumentation;
 var init_undici = __esm(() => {
   init_esm2();
   import_instrumentation5 = __toESM(require_src8(), 1);
   import_api15 = __toESM(require_src(), 1);
-  import_core106 = __toESM(require_src6(), 1);
+  import_core107 = __toESM(require_src6(), 1);
   import_semantic_conventions3 = __toESM(require_src5(), 1);
   UndiciInstrumentation = class UndiciInstrumentation extends import_instrumentation5.InstrumentationBase {
     __init() {
@@ -204888,7 +204902,7 @@ var init_undici = __esm(() => {
       if (shouldIgnoreReq) {
         return;
       }
-      const startTime = import_core106.hrTime();
+      const startTime = import_core107.hrTime();
       let requestUrl;
       try {
         requestUrl = new URL4(request2.path, request2.origin);
@@ -205061,7 +205075,7 @@ var init_undici = __esm(() => {
           metricsAttributes[key] = attributes[key];
         }
       });
-      const durationSeconds = import_core106.hrTimeToMilliseconds(import_core106.hrTimeDuration(startTime, import_core106.hrTime())) / 1000;
+      const durationSeconds = import_core107.hrTimeToMilliseconds(import_core107.hrTimeDuration(startTime, import_core107.hrTime())) / 1000;
       this._httpClientDurationHistogram.record(durationSeconds, metricsAttributes);
     }
     getRequestMethod(original) {
@@ -205606,7 +205620,7 @@ var init_debug_build3 = __esm(() => {
 });
 
 // ../../node_modules/.bun/@sentry+node@10.52.0+779e4caf6ead3695/node_modules/@sentry/node/build/esm/integrations/tracing/express.js
-var import_instrumentation6, import_api16, import_core109, INTEGRATION_NAME23 = "Express", SUPPORTED_VERSIONS, instrumentExpress, ExpressInstrumentation, _expressIntegration = (options) => {
+var import_instrumentation6, import_api16, import_core110, INTEGRATION_NAME23 = "Express", SUPPORTED_VERSIONS, instrumentExpress, ExpressInstrumentation, _expressIntegration = (options) => {
   return {
     name: INTEGRATION_NAME23,
     setupOnce() {
@@ -205620,7 +205634,7 @@ var init_express2 = __esm(() => {
   init_debug_build3();
   import_instrumentation6 = __toESM(require_src8(), 1);
   import_api16 = __toESM(require_src(), 1);
-  import_core109 = __toESM(require_src6(), 1);
+  import_core110 = __toESM(require_src6(), 1);
   SUPPORTED_VERSIONS = [">=4.0.0 <6"];
   instrumentExpress = generateInstrumentOnce(INTEGRATION_NAME23, (options) => new ExpressInstrumentation(options));
   ExpressInstrumentation = class ExpressInstrumentation extends import_instrumentation6.InstrumentationBase {
@@ -205633,8 +205647,8 @@ var init_express2 = __esm(() => {
           patchExpressModule(express, () => ({
             ...this.getConfig(),
             onRouteResolved(route) {
-              const rpcMetadata = import_core109.getRPCMetadata(import_api16.context.active());
-              if (route && rpcMetadata?.type === import_core109.RPCType.HTTP) {
+              const rpcMetadata = import_core110.getRPCMetadata(import_api16.context.active());
+              if (route && rpcMetadata?.type === import_core110.RPCType.HTTP) {
                 rpcMetadata.route = route;
               }
             }
@@ -209530,13 +209544,13 @@ function addFastifyV3SpanAttributes(span) {
     span.updateName(updatedName);
   }
 }
-var import_api18, import_core111, import_instrumentation7, import_semantic_conventions4, PACKAGE_VERSION = "0.1.0", PACKAGE_NAME2 = "@sentry/instrumentation-fastify-v3", ANONYMOUS_NAME = "anonymous", hooksNamesToWrap, FastifyInstrumentationV3;
+var import_api18, import_core112, import_instrumentation7, import_semantic_conventions4, PACKAGE_VERSION = "0.1.0", PACKAGE_NAME2 = "@sentry/instrumentation-fastify-v3", ANONYMOUS_NAME = "anonymous", hooksNamesToWrap, FastifyInstrumentationV3;
 var init_instrumentation = __esm(() => {
   init_esm2();
   init_AttributeNames();
   init_utils14();
   import_api18 = __toESM(require_src(), 1);
-  import_core111 = __toESM(require_src6(), 1);
+  import_core112 = __toESM(require_src6(), 1);
   import_instrumentation7 = __toESM(require_src8(), 1);
   import_semantic_conventions4 = __toESM(require_src5(), 1);
   hooksNamesToWrap = new Set([
@@ -209569,9 +209583,9 @@ var init_instrumentation = __esm(() => {
         }
         instrumentation._wrap(reply, "send", instrumentation._patchSend());
         const anyRequest = request2;
-        const rpcMetadata = import_core111.getRPCMetadata(import_api18.context.active());
+        const rpcMetadata = import_core112.getRPCMetadata(import_api18.context.active());
         const routeName = anyRequest.routeOptions ? anyRequest.routeOptions.url : request2.routerPath;
-        if (routeName && rpcMetadata?.type === import_core111.RPCType.HTTP) {
+        if (routeName && rpcMetadata?.type === import_core112.RPCType.HTTP) {
           rpcMetadata.route = routeName;
         }
         const method = request2.method || "GET";
@@ -250946,7 +250960,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260914.9",
+    version: "2.260914.11",
     private: true,
     type: "module",
     exports: {
@@ -378778,6 +378792,9 @@ var init_automations3 = __esm(() => {
     transactionalEmissions: exports_external.boolean().openapi({
       description: "Transactional publication (G5, #988): buffer the run's emit_event publishes and flush them in order " + "only when every action succeeded; a failed run publishes zero"
     }),
+    allowInstanceSenders: exports_external.boolean().openapi({
+      description: "Loop guard opt-in (#1148): act on events sent by one of the tenant\u2019s own instances"
+    }),
     maxConcurrency: exports_external.number().int().nullable().openapi({
       description: "Per-automation concurrency limit (#1108). null = queued per instance with the engine default; " + "set = a queue private to this automation, 1 being strict single-flight"
     }),
@@ -378803,6 +378820,9 @@ var init_automations3 = __esm(() => {
     transactionalEmissions: exports_external.boolean().default(false).openapi({
       description: "Transactional publication (G5, #988): buffer the run's emit_event publishes and flush them in order " + "only when every action succeeded; a failed run publishes zero. Default false = immediate publishing"
     }),
+    allowInstanceSenders: exports_external.boolean().default(false).openapi({
+      description: "Loop guard opt-in (#1148): by default events sent by one of the tenant\u2019s own instances " + "(payload.senderInstanceId) are skipped. True = act on them anyway"
+    }),
     maxConcurrency: exports_external.number().int().min(1).nullable().optional().openapi({
       description: "Per-automation concurrency limit (#1108). Omit/null = today\u2019s per-instance queueing with the engine " + "default; 1 = strict single-flight, which is what a read-before-write action needs"
     }),
@@ -384671,6 +384691,7 @@ var init_automations4 = __esm(() => {
     enabled: exports_external.boolean().default(true).describe("Whether automation is enabled"),
     priority: exports_external.number().int().default(0).describe("Priority (higher runs first)"),
     transactionalEmissions: exports_external.boolean().default(false).describe("Transactional publication (G5, #988): buffer the run's emit_event publishes and flush them in order " + "only when every action succeeded; a failed run publishes zero. Default false = immediate publishing"),
+    allowInstanceSenders: exports_external.boolean().default(false).describe("Loop guard opt-in (#1148): by default events sent by one of the tenant\u2019s own instances " + "(payload.senderInstanceId) are skipped. True = act on them anyway"),
     maxConcurrency: exports_external.number().int().min(1).nullable().optional().describe("Per-automation concurrency limit (#1108). Omit/null = today\u2019s per-instance queueing with the engine " + "default; 1 = strict single-flight, which is what a read-before-write action needs"),
     concurrencyKey: exports_external.string().min(1).nullable().optional().describe("Template over the event payload partitioning this automation\u2019s queue (#1108), e.g. " + '"{{payload.from.id}}" to serialize per chat; omit/null = one queue for the whole automation')
   });
@@ -415552,6 +415573,7 @@ var src_default8 = plugin9;
 
 // ../channel-whatsapp/src/plugin.ts
 init_src2();
+init_src();
 
 // ../channel-whatsapp/src/auth.ts
 init_src();
@@ -530001,6 +530023,23 @@ class WhatsAppPlugin extends BaseChannelPlugin {
   getLidMappingCache(instanceId) {
     return this.lidMappingCache.get(instanceId) ?? new Map;
   }
+  resolveSenderInstanceId(instanceId, from, isFromMe2) {
+    if (isFromMe2)
+      return instanceId;
+    const bare = (jid) => jid?.replace(/:.*$/, "").replace(/@.*$/, "") || undefined;
+    const lidCache = this.getLidMappingCache(instanceId);
+    const fromJid2 = from.includes("@") ? from : undefined;
+    const candidates = new Set([bare(from), bare(fromJid2 && lidCache.get(fromJid2))].filter(Boolean));
+    const tenantId = resolveInstanceOwnerTenantId(instanceId);
+    for (const [otherId, sock] of this.sockets) {
+      const user = sock.user;
+      if (!user || resolveInstanceOwnerTenantId(otherId) !== tenantId)
+        continue;
+      if (candidates.has(bare(user.id)) || candidates.has(bare(user.lid)))
+        return otherId;
+    }
+    return;
+  }
   isMentioningOwner(mentionedJids, ownerJid, lidCache) {
     const ownerPhone = ownerJid.replace(/:.*$/, "").replace(/@.*$/, "");
     return mentionedJids.some((jid) => {
@@ -531674,6 +531713,7 @@ class WhatsAppPlugin extends BaseChannelPlugin {
         mimeType: content.mimeType
       },
       replyToId,
+      senderInstanceId: this.resolveSenderInstanceId(instanceId, from, isFromMe2),
       rawPayload: extendedPayload,
       timings
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260914.9",
+  "version": "2.260914.11",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/automagik-dev/omni.git",