@openclaw/whatsapp 2026.10.5-beta.4 → 2026.10.10-beta.2

package/dist/doctor-contract-api.js

@@ -39,7 +39,7 @@ async function listSources(params) {
 	}
 	const sources = /* @__PURE__ */ new Map();
 	for (const entry of await fs$1.readdir(params.oauthDir, { withFileTypes: true })) {
-		const name = runtime_doctor_migrations_exports.resolveLegacyMigrationSourcePath?.(entry.name) ?? entry.name;
+		const name = runtime_doctor_migrations_exports.resolveLegacyMigrationSourcePath(entry.name);
 		if (!entry.isFile() || !isWhatsAppBaileysAuthFileName(name)) continue;
 		const source = sources.get(name) ?? {
 			name,
@@ -80,7 +80,7 @@ const whatsappLegacyStateMigration = {
 		};
 		const assertCurrent = params.context.channelIngressQueues?.find((entry) => entry.channelId === "whatsapp")?.assertCurrent;
 		const { backupLegacyStateSource } = runtime_doctor_migrations_exports;
-		if (!assertCurrent || !backupLegacyStateSource) return warn("WhatsApp credential import requires offline Doctor repair. Update OpenClaw core and run openclaw doctor --fix; original files remain unchanged.");
+		if (!assertCurrent) return warn("WhatsApp credential import requires offline Doctor repair. Update OpenClaw core and run openclaw doctor --fix; original files remain unchanged.");
 		const backups = [];
 		for (const source of sources) backups.push({
 			source,
@@ -105,7 +105,7 @@ const whatsappLegacyStateMigration = {
 		const canonical = await credentials.exists(targetCreds) ? await credentials.read(targetCreds) : void 0;
 		const legacy = backups.find(({ source }) => source.name === "creds.json");
 		if (!legacy) return warn("WhatsApp shared-root key files have no creds.json identity. Kept all original files and private .migrated backups; restore the original creds.json before retrying Doctor.", Boolean(canonical));
-		if (canonical && !canonical.buffer.equals(legacy.backup.bytes)) return warn("WhatsApp canonical credentials differ from the legacy shared root. Kept both complete sets and private .migrated backups; choose the intended authDir before removing either set.", true);
+		if (canonical && !canonical.buffer.equals(legacy.backup.bytes)) return warn("WhatsApp current credentials differ from the legacy shared root. Kept both complete sets and private .migrated backups; choose the intended authDir before removing either set.", true);
 		const targetNames = await fs$1.readdir(path.join(params.oauthDir, targetDir)).catch((error) => {
 			if (extractErrorCode(error) === "ENOENT") return [];
 			throw error;
@@ -124,7 +124,7 @@ const whatsappLegacyStateMigration = {
 		const receipts = receiptStore.withCurrent({ assertCurrent });
 		const sourceIdentity = legacy.backup.snapshot.sha256;
 		const previous = await receipts.lookup(sourceIdentity);
-		if (previous && (!canonical || previous.targetDigest !== credentialSetDigest(targetFiles))) return warn("WhatsApp credential migration previously started, but its complete canonical credential set is absent or changed. Kept source files and backups; restore the complete intended account or select its authDir explicitly. Doctor will not recreate credentials after logout.", Boolean(canonical));
+		if (previous && (!canonical || previous.targetDigest !== credentialSetDigest(targetFiles))) return warn("WhatsApp credential migration previously started, but its complete current credential set is absent or changed. Kept source files and backups; restore the complete intended account or select its authDir explicitly. Doctor will not recreate credentials after logout.", Boolean(canonical));
 		if (!canonical) {
 			const sourceNames = new Set(sources.map((source) => source.name));
 			if (targetNames.some((name) => isWhatsAppBaileysAuthFileName(name) && !sourceNames.has(name))) return warn("WhatsApp default account contains unmatched auth files without creds.json. Kept the incomplete account and legacy credentials separate; choose the intended credential set before retrying Doctor.");
@@ -153,7 +153,7 @@ const whatsappLegacyStateMigration = {
 				private: true
 			});
 			const target = await credentials.read(relativePath);
-			if (!target.buffer.equals(backup.bytes)) throw new Error("WhatsApp canonical credentials changed during import; original files retained.");
+			if (!target.buffer.equals(backup.bytes)) throw new Error("WhatsApp current credentials changed during import; original files retained.");
 			targets.push({
 				source,
 				backup,
@@ -170,7 +170,7 @@ const whatsappLegacyStateMigration = {
 					requireDirectories: true
 				});
 				const current = readRegularFileSync({ filePath: targetPath });
-				if (current.stat.dev !== target.stat.dev || current.stat.ino !== target.stat.ino || !current.buffer.equals(target.buffer)) throw new Error("WhatsApp canonical credentials changed during import; original backup retained.");
+				if (current.exactIdentity.dev !== target.exactIdentity.dev || current.exactIdentity.ino !== target.exactIdentity.ino || !current.buffer.equals(target.buffer)) throw new Error("WhatsApp current credentials changed during import; original backup retained.");
 			});
 			changes.push(`Moved WhatsApp auth ${source.name} into the default account; backup: ${backup.backupPath}`);
 		}

package/dist/light-runtime-api.js

@@ -1,5 +1,5 @@
-import { t as createWhatsAppLoginTool } from "./.setup/agent-tools-login-CB7OQbli.mjs";
+import { t as createWhatsAppLoginTool } from "./.setup/agent-tools-login-n7QVE3Am.mjs";
 import { b as webAuthExists, c as logoutWeb, h as readWebSelfId, l as pickWebChannel, o as getWebAuthAgeMs, s as logWebSelfId, t as WA_WEB_AUTH_DIR, v as resolveDefaultWebAuthDir } from "./.setup/auth-store-DOBi5BPe.mjs";
-import { t as getActiveWebListener } from "./.setup/active-listener-CDjoX9QR.mjs";
+import { t as getActiveWebListener } from "./.setup/active-listener-idMFscyE.mjs";
 import { n as getStatusCode, t as formatError } from "./.setup/session-errors-B8UcAnZN.mjs";
 export { WA_WEB_AUTH_DIR, createWhatsAppLoginTool, formatError, getActiveWebListener, getStatusCode, getWebAuthAgeMs, logWebSelfId, logoutWeb, pickWebChannel, readWebSelfId, resolveDefaultWebAuthDir, webAuthExists };

package/dist/login-qr-api.js

@@ -1,2 +1 @@
-import { startWebLoginWithQr, waitForWebLogin } from "./login-qr-runtime.js";
-export { startWebLoginWithQr, waitForWebLogin };
+export { startWebLoginWithQr, waitForWebLogin } from "./login-qr-runtime.js";

package/dist/login-qr-runtime.js

@@ -1,10 +1,10 @@
 //#region extensions/whatsapp/login-qr-runtime.ts
 async function startWebLoginWithQr(...args) {
-	const { startWebLoginWithQr: startWebLoginWithQrLocal } = await import("./.setup/login-qr-BAWbPonj.mjs");
+	const { startWebLoginWithQr: startWebLoginWithQrLocal } = await import("./.setup/login-qr-B_6dpBr-.mjs");
 	return await startWebLoginWithQrLocal(...args);
 }
 async function waitForWebLogin(...args) {
-	const { waitForWebLogin: waitForWebLoginLocal } = await import("./.setup/login-qr-BAWbPonj.mjs");
+	const { waitForWebLogin: waitForWebLoginLocal } = await import("./.setup/login-qr-B_6dpBr-.mjs");
 	return await waitForWebLoginLocal(...args);
 }
 //#endregion

package/dist/runtime-api.js

@@ -1,16 +1,16 @@
 import { a as readWebCredsJsonRawSync, n as hasWebCredsSync, o as resolveWebCredsBackupPath, s as resolveWebCredsPath } from "./.setup/creds-files-B8WcOAmE.mjs";
-import { n as whatsAppActionRuntime, t as handleWhatsAppAction } from "./.setup/action-runtime-DUSkWTiZ.mjs";
-import { i as sendTypingWhatsApp, n as sendPollWhatsApp, r as sendReactionWhatsApp, t as sendMessageWhatsApp } from "./.setup/send-CLBfAzd6.mjs";
-import { a as setWhatsAppRuntime } from "./.setup/runtime-BLlToOi6.mjs";
+import { n as whatsAppActionRuntime, t as handleWhatsAppAction } from "./.setup/action-runtime-B1UcIuRG.mjs";
+import { i as sendTypingWhatsApp, n as sendPollWhatsApp, r as sendReactionWhatsApp, t as sendMessageWhatsApp } from "./.setup/send-CIzCLFrJ.mjs";
+import { a as setWhatsAppRuntime } from "./.setup/runtime-Botmatgn.mjs";
 import { startWebLoginWithQr, waitForWebLogin } from "./login-qr-runtime.js";
-import { t as createWhatsAppLoginTool } from "./.setup/agent-tools-login-CB7OQbli.mjs";
+import { t as createWhatsAppLoginTool } from "./.setup/agent-tools-login-n7QVE3Am.mjs";
 import { A as waitForCredsSaveQueue, M as writeCredsJsonAtomically, _ as readWebSelfIdentityForDecision, a as formatWhatsAppWebAuthStatusState, b as webAuthExists, c as logoutWeb, d as readWebAuthExistsForDecision, f as readWebAuthSnapshot, g as readWebSelfIdentity, h as readWebSelfId, j as waitForCredsSaveQueueWithTimeout, l as pickWebChannel, m as readWebAuthState, n as WHATSAPP_AUTH_UNSTABLE_CODE, o as getWebAuthAgeMs, p as readWebAuthSnapshotBestEffort, r as WhatsAppAuthUnstableError, s as logWebSelfId, t as WA_WEB_AUTH_DIR, u as readWebAuthExistsBestEffort, v as resolveDefaultWebAuthDir, y as restoreCredsFromBackupIfNeeded } from "./.setup/auth-store-DOBi5BPe.mjs";
 import { t as DEFAULT_WEB_MEDIA_BYTES } from "./.setup/constants-C7m81BNe.mjs";
-import { n as resolveWebAccountId, t as getActiveWebListener } from "./.setup/active-listener-CDjoX9QR.mjs";
-import { i as waitForWaConnection, r as createWaSocket, s as newConnectionId } from "./.setup/socket-close-C9OU9mVN.mjs";
+import { n as resolveWebAccountId, t as getActiveWebListener } from "./.setup/active-listener-idMFscyE.mjs";
+import { i as waitForWaConnection, r as createWaSocket, s as newConnectionId } from "./.setup/socket-close-BhMQls5y.mjs";
 import { n as getStatusCode, t as formatError } from "./.setup/session-errors-B8UcAnZN.mjs";
-import { p as extractText, s as extractContactContext, u as extractLocationData } from "./.setup/send-api-COzRvqXx.mjs";
-import { a as loadWebMediaRaw, c as monitorWebInbox, i as loadWebMedia, l as resetWebInboundDedupe, n as LocalMediaAccessError, o as optimizeImageToJpeg, r as getDefaultLocalRoots, s as optimizeImageToPng, t as monitorWebChannel } from "./.setup/monitor-CmXEQad9.mjs";
-import { t as loginWeb } from "./.setup/login-DUx5JYuW.mjs";
+import { p as extractText, s as extractContactContext, u as extractLocationData } from "./.setup/send-api-Ck6tezjw.mjs";
+import { a as loadWebMediaRaw, c as monitorWebInbox, i as loadWebMedia, l as resetWebInboundDedupe, n as LocalMediaAccessError, o as optimizeImageToJpeg, r as getDefaultLocalRoots, s as optimizeImageToPng, t as monitorWebChannel } from "./.setup/monitor-5tf46zdS.mjs";
+import { t as loginWeb } from "./.setup/login-Bk8OQeE6.mjs";
 import { HEARTBEAT_PROMPT, HEARTBEAT_TOKEN, SILENT_REPLY_TOKEN, stripHeartbeatToken } from "openclaw/plugin-sdk/reply-runtime";
 export { DEFAULT_WEB_MEDIA_BYTES, HEARTBEAT_PROMPT, HEARTBEAT_TOKEN, LocalMediaAccessError, SILENT_REPLY_TOKEN, WA_WEB_AUTH_DIR, WHATSAPP_AUTH_UNSTABLE_CODE, WhatsAppAuthUnstableError, createWaSocket, createWhatsAppLoginTool, extractContactContext, extractLocationData, extractText, formatError, formatWhatsAppWebAuthStatusState, getActiveWebListener, getDefaultLocalRoots, getStatusCode, getWebAuthAgeMs, handleWhatsAppAction, hasWebCredsSync, loadWebMedia, loadWebMediaRaw, logWebSelfId, loginWeb, logoutWeb, monitorWebChannel, monitorWebInbox, newConnectionId, optimizeImageToJpeg, optimizeImageToPng, pickWebChannel, readWebCredsJsonRawSync as readCredsJsonRaw, readWebAuthExistsBestEffort, readWebAuthExistsForDecision, readWebAuthSnapshot, readWebAuthSnapshotBestEffort, readWebAuthState, readWebSelfId, readWebSelfIdentity, readWebSelfIdentityForDecision, resetWebInboundDedupe, resolveDefaultWebAuthDir, resolveWebAccountId, resolveWebCredsBackupPath, resolveWebCredsPath, restoreCredsFromBackupIfNeeded, sendMessageWhatsApp, sendPollWhatsApp, sendReactionWhatsApp, sendTypingWhatsApp, setWhatsAppRuntime, startWebLoginWithQr, stripHeartbeatToken, waitForCredsSaveQueue, waitForCredsSaveQueueWithTimeout, waitForWaConnection, waitForWebLogin, webAuthExists, whatsAppActionRuntime, writeCredsJsonAtomically };

package/dist/runtime-setter-api.js

@@ -1,2 +1 @@
-import { a as setWhatsAppRuntime } from "./.setup/runtime-BLlToOi6.mjs";
-export { setWhatsAppRuntime };
+export { a as setWhatsAppRuntime } from "./.setup/runtime-Botmatgn.mjs";

package/dist/security-contract-api.js

@@ -1,2 +1 @@
-import { n as unsupportedSecretRefSurfacePatterns, t as collectUnsupportedSecretRefConfigCandidates } from "./.setup/security-contract-nAzD945y.mjs";
-export { collectUnsupportedSecretRefConfigCandidates, unsupportedSecretRefSurfacePatterns };
+export { t as collectUnsupportedSecretRefConfigCandidates, n as unsupportedSecretRefSurfacePatterns } from "./.setup/security-contract-nAzD945y.mjs";

package/dist/setup-entry.js

@@ -5,11 +5,11 @@ var setup_entry_default = defineBundledChannelSetupEntry({
 	importMetaUrl: import.meta.url,
 	features: { legacySessionSurfaces: true },
 	plugin: {
-		specifier: fileURLToPath(new URL(".setup/setup-plugin-api-8WdNCjRW.mjs", import.meta.url).href),
+		specifier: fileURLToPath(new URL(".setup/setup-plugin-api-B6Nc07Ua.mjs", import.meta.url).href),
 		exportName: "whatsappSetupPlugin"
 	},
 	legacySessionSurface: {
-		specifier: fileURLToPath(new URL(".setup/legacy-session-surface-api-B2szjq4r.mjs", import.meta.url).href),
+		specifier: fileURLToPath(new URL(".setup/legacy-session-surface-api-BwP_Pgmu.mjs", import.meta.url).href),
 		exportName: "whatsappLegacySessionSurface"
 	}
 });

package/dist/setup-plugin-api.js

@@ -1,2 +1 @@
-import { t as whatsappSetupPlugin } from "./.setup/channel.setup-BJWEyQlF.mjs";
-export { whatsappSetupPlugin };
+export { t as whatsappSetupPlugin } from "./.setup/channel.setup-BACWTI6Q.mjs";

package/node_modules/typebox/build/value/clean/from_object.mjs

@@ -12,7 +12,7 @@ export function FromObject(context, type, value) {
         return value;
     const additionalProperties = GetAdditionalProperties(type);
     for (const key of Guard.Keys(value)) {
-        if (Guard.HasPropertyKey(type.properties, key)) {
+        if (Guard.HasPropertyKey(type.properties, key) && IsSchema(type.properties[key])) {
             value[key] = FromType(context, type.properties[key], value[key]);
             continue;
         }

package/node_modules/typebox/package.json

@@ -1,7 +1,7 @@
 {
   "name": "typebox",
   "description": "Json Schema Type Builder with Static Type Resolution for TypeScript",
-  "version": "1.3.34",
+  "version": "1.3.35",
   "keywords": [
     "typescript",
     "jsonschema"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/whatsapp",
-  "version": "2026.10.5-beta.4",
+  "version": "2026.10.10-beta.2",
   "description": "OpenClaw WhatsApp channel plugin for WhatsApp Web chats.",
   "repository": {
     "type": "git",
@@ -10,10 +10,10 @@
   "dependencies": {
     "audio-decode": "3.12.0",
     "baileys": "7.0.0-rc14",
-    "typebox": "1.3.34"
+    "typebox": "1.3.35"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.10.5-beta.4"
+    "openclaw": ">=2026.10.10-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -41,6 +41,12 @@
       "docsLabel": "whatsapp",
       "blurb": "works with your own number; recommend a separate phone + eSIM.",
       "systemImage": "message",
+      "doctorCapabilities": {
+        "dmAllowFromMode": "topOnly",
+        "groupModel": "sender",
+        "groupAllowFromFallbackToAllowFrom": true,
+        "warnOnEmptyGroupSenderAllowlist": true
+      },
       "persistedAuthState": {
         "specifier": "./dist/auth-presence.js",
         "exportName": "hasAnyWhatsAppAuth"
@@ -65,11 +71,11 @@
       "minHostVersion": ">=2026.4.25"
     },
     "compat": {
-      "pluginApi": ">=2026.10.5-beta.4"
+      "pluginApi": ">=2026.10.10-beta.2"
     },
     "build": {
       "bundledDist": false,
-      "openclawVersion": "2026.10.5-beta.4"
+      "openclawVersion": "2026.10.10-beta.2"
     },
     "release": {
       "publishToClawHub": true,

package/dist/.setup/audio-preflight.runtime-Dg8oZgre.mjs

@@ -1,2 +0,0 @@
-import { transcribeFirstAudio } from "openclaw/plugin-sdk/media-runtime";
-export { transcribeFirstAudio };

package/dist/.setup/legacy-session-surface-api-B2szjq4r.mjs

@@ -1,2 +0,0 @@
-import { whatsappLegacySessionSurface } from "../legacy-session-surface-api.js";
-export { whatsappLegacySessionSurface };

package/dist/.setup/reply-resolver.runtime-Ded8D58Y.mjs

@@ -1,2 +0,0 @@
-import { getReplyFromConfig } from "openclaw/plugin-sdk/reply-runtime";
-export { getReplyFromConfig };

package/dist/.setup/runtime-BLlToOi6.mjs

@@ -1,21 +0,0 @@
-import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
-//#region extensions/whatsapp/src/runtime.ts
-const runtimeStore = createPluginRuntimeStore({
-	pluginId: "whatsapp",
-	errorMessage: "WhatsApp runtime not initialized"
-});
-const channelRuntimeStore = createPluginRuntimeStore({
-	key: "plugin-runtime:whatsapp:channel-context-owner",
-	errorMessage: "WhatsApp channel runtime not initialized"
-});
-/** Injects current helpers while preserving the process-lifetime channel context owner. */
-function setWhatsAppRuntime(next) {
-	if (!channelRuntimeStore.tryGetRuntime()) channelRuntimeStore.setRuntime(next.channel);
-	runtimeStore.setRuntime(next);
-}
-const getWhatsAppRuntime = runtimeStore.getRuntime;
-const getOptionalWhatsAppRuntime = runtimeStore.tryGetRuntime;
-const getWhatsAppChannelRuntime = channelRuntimeStore.getRuntime;
-const getOptionalWhatsAppChannelRuntime = channelRuntimeStore.tryGetRuntime;
-//#endregion
-export { setWhatsAppRuntime as a, getWhatsAppRuntime as i, getOptionalWhatsAppRuntime as n, getWhatsAppChannelRuntime as r, getOptionalWhatsAppChannelRuntime as t };

package/dist/.setup/setup-plugin-api-8WdNCjRW.mjs

@@ -1,3 +0,0 @@
-import { t as whatsappSetupPlugin } from "./channel.setup-BJWEyQlF.mjs";
-import "../setup-plugin-api.js";
-export { whatsappSetupPlugin };