@openclaw/whatsapp 2026.5.19 → 2026.5.20-beta.2

package/dist/{access-control-Blo69-dW.js → access-control-p_vcYDW7.js}

@@ -1,7 +1,7 @@
-import { a as resolveWhatsAppAccount } from "./accounts-CJNZl-3e.js";
-import { l as isSelfChatMode, n as normalizeE164 } from "./text-runtime-DyR0XOJ4.js";
-import { a as getSelfIdentity, o as getSenderIdentity } from "./identity-CVFJuB0Q.js";
-import { t as resolveWhatsAppRuntimeGroupPolicy } from "./runtime-group-policy-BH_U23qp.js";
+import { a as resolveWhatsAppAccount } from "./accounts-BPYgj8Fv.js";
+import { l as isSelfChatMode, n as normalizeE164 } from "./text-runtime-Dk37KYHj.js";
+import { a as getSelfIdentity, o as getSenderIdentity } from "./identity-xoLLdqEv.js";
+import { t as resolveWhatsAppRuntimeGroupPolicy } from "./runtime-group-policy-DeSRFXEV.js";
 import { defaultRuntime } from "openclaw/plugin-sdk/runtime-env";
 import { resolveChannelGroupPolicy, resolveChannelGroupRequireMention } from "openclaw/plugin-sdk/channel-policy";
 import { createChannelPairingChallengeIssuer } from "openclaw/plugin-sdk/channel-pairing";

package/dist/{accounts-CJNZl-3e.js → accounts-BPYgj8Fv.js}

@@ -1,6 +1,6 @@
-import { t as resolveMergedWhatsAppAccountConfig } from "./account-config-D3OXPtpW.js";
-import { n as listConfiguredAccountIds, r as resolveDefaultWhatsAppAccountId, t as listAccountIds } from "./account-ids-DgtV_RiP.js";
-import { t as hasWebCredsSync } from "./creds-files-_2V8jzQa.js";
+import { t as resolveMergedWhatsAppAccountConfig } from "./account-config-Bxl16soz.js";
+import { n as listConfiguredAccountIds, r as resolveDefaultWhatsAppAccountId, t as listAccountIds } from "./account-ids-CB5SOWjc.js";
+import { n as hasWebCredsRegularFileSync, r as hasWebCredsSync } from "./creds-files-B1kSWtBg.js";
 import fs from "node:fs";
 import path from "node:path";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId, resolveUserPath } from "openclaw/plugin-sdk/account-core";
@@ -36,11 +36,7 @@ function resolveLegacyAuthDir() {
 	return resolveOAuthDir();
 }
 function legacyAuthExists(authDir) {
-	try {
-		return fs.existsSync(path.join(authDir, "creds.json"));
-	} catch {
-		return false;
-	}
+	return hasWebCredsRegularFileSync(authDir);
 }
 function resolveWhatsAppAuthDir(params) {
 	const accountId = params.accountId.trim() || DEFAULT_ACCOUNT_ID;

package/dist/{action-runtime-cZLWNUXF.js → action-runtime-D4UqEXqf.js}

@@ -1,7 +1,7 @@
-import { a as resolveWhatsAppAccount } from "./accounts-CJNZl-3e.js";
-import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-Ba7sH80H.js";
-import { t as resolveWhatsAppReactionLevel } from "./reaction-level-DeO7ktWb.js";
-import { r as sendReactionWhatsApp } from "./send-BtGELs96.js";
+import { a as resolveWhatsAppAccount } from "./accounts-BPYgj8Fv.js";
+import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-CV-iBmSG.js";
+import { t as resolveWhatsAppReactionLevel } from "./reaction-level-BqMOEBeq.js";
+import { r as sendReactionWhatsApp } from "./send-E_kMiuZP.js";
 import { ToolAuthorizationError, createActionGate, jsonResult, readReactionParams, readStringParam } from "openclaw/plugin-sdk/channel-actions";
 //#region extensions/whatsapp/src/action-runtime-target-auth.ts
 function resolveAuthorizedWhatsAppOutboundTarget(params) {

package/dist/action-runtime-api.js

@@ -1,2 +1,2 @@
-import { t as handleWhatsAppAction } from "./action-runtime-cZLWNUXF.js";
+import { t as handleWhatsAppAction } from "./action-runtime-D4UqEXqf.js";
 export { handleWhatsAppAction };

package/dist/action-runtime.runtime.js

@@ -1,2 +1,2 @@
-import { t as handleWhatsAppAction } from "./action-runtime-cZLWNUXF.js";
+import { t as handleWhatsAppAction } from "./action-runtime-D4UqEXqf.js";
 export { handleWhatsAppAction };

package/dist/{active-listener-C4ClVut4.js → active-listener-B4SDebQ6.js}

@@ -1,5 +1,5 @@
-import { r as resolveDefaultWhatsAppAccountId } from "./account-ids-DgtV_RiP.js";
-import { t as getRegisteredWhatsAppConnectionController } from "./connection-controller-registry-D_iIGz5m.js";
+import { r as resolveDefaultWhatsAppAccountId } from "./account-ids-CB5SOWjc.js";
+import { t as getRegisteredWhatsAppConnectionController } from "./connection-controller-registry-TSX_udJp.js";
 //#region extensions/whatsapp/src/active-listener.ts
 function resolveWebAccountId(params) {
 	return (params.accountId ?? "").trim() || resolveDefaultWhatsAppAccountId(params.cfg);

package/dist/{agent-tools-login-DpRxLNRB.js → agent-tools-login-BDzvb3ee.js}

@@ -10,7 +10,6 @@ function createWhatsAppLoginTool() {
 	return {
 		label: "WhatsApp Login",
 		name: "whatsapp_login",
-		ownerOnly: true,
 		description: "Generate a WhatsApp QR code for linking, or wait for the scan to complete.",
 		parameters: Type.Object({
 			action: Type.Unsafe({

package/dist/api.js

@@ -1,21 +1,21 @@
-import { r as resolveDefaultWhatsAppAccountId, t as listAccountIds } from "./account-ids-DgtV_RiP.js";
-import { a as resolveWhatsAppAccount, i as listWhatsAppAuthDirs, n as hasAnyWhatsAppAuth, o as resolveWhatsAppAuthDir, r as listEnabledWhatsAppAccounts, s as resolveWhatsAppMediaMaxBytes, t as DEFAULT_WHATSAPP_MEDIA_MAX_MB } from "./accounts-CJNZl-3e.js";
-import { a as normalizeWhatsAppAllowFromEntries, c as normalizeWhatsAppTarget, i as looksLikeWhatsAppTargetId, r as isWhatsAppUserTarget, s as normalizeWhatsAppMessagingTarget, t as isWhatsAppGroupJid } from "./normalize-target-MB6Z_4Bn.js";
-import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-Ba7sH80H.js";
-import "./reaction-level-DeO7ktWb.js";
-import { c as assertWebChannel, d as markdownToWhatsApp, f as resolveJidToE164, l as isSelfChatMode, m as toWhatsappJidWithLid, n as normalizeE164, p as toWhatsappJid, r as resolveUserPath, u as jidToE164 } from "./text-runtime-DyR0XOJ4.js";
-import "./send-BtGELs96.js";
-import { t as whatsappPlugin } from "./channel-CHsR8MoG.js";
-import { n as WHATSAPP_LEGACY_OUTBOUND_SEND_DEP_KEYS } from "./outbound-base-ARCS45ql.js";
-import { t as whatsappCommandPolicy } from "./command-policy-O8sRnqUV.js";
-import { a as resolveWhatsAppGroupRequireMention, o as resolveWhatsAppGroupToolPolicy, s as resolveWhatsAppGroupIntroHint } from "./setup-core-P6dnz4Ur.js";
-import "./config-schema-Dmo66Ubb.js";
-import { t as whatsappSetupPlugin } from "./channel.setup-BiuhxbjG.js";
-import { t as DEFAULT_WEB_MEDIA_BYTES } from "./constants-yKXGCGU9.js";
-import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-QH8Oe8bc.js";
-import { n as testing } from "./access-control-Blo69-dW.js";
-import { p as extractText, t as createWebSendApi } from "./send-api-BvUGZEIA.js";
-import { r as waitForWaConnection, t as createWaSocket } from "./session-DqDc1usL.js";
+import { r as resolveDefaultWhatsAppAccountId, t as listAccountIds } from "./account-ids-CB5SOWjc.js";
+import { a as resolveWhatsAppAccount, i as listWhatsAppAuthDirs, n as hasAnyWhatsAppAuth, o as resolveWhatsAppAuthDir, r as listEnabledWhatsAppAccounts, s as resolveWhatsAppMediaMaxBytes, t as DEFAULT_WHATSAPP_MEDIA_MAX_MB } from "./accounts-BPYgj8Fv.js";
+import { a as normalizeWhatsAppAllowFromEntries, c as normalizeWhatsAppTarget, i as looksLikeWhatsAppTargetId, r as isWhatsAppUserTarget, s as normalizeWhatsAppMessagingTarget, t as isWhatsAppGroupJid } from "./normalize-target-bVWjgftN.js";
+import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-CV-iBmSG.js";
+import "./reaction-level-BqMOEBeq.js";
+import { c as assertWebChannel, d as markdownToWhatsApp, f as resolveJidToE164, l as isSelfChatMode, m as toWhatsappJidWithLid, n as normalizeE164, p as toWhatsappJid, r as resolveUserPath, u as jidToE164 } from "./text-runtime-Dk37KYHj.js";
+import "./send-E_kMiuZP.js";
+import { t as whatsappPlugin } from "./channel-BVMD1oZL.js";
+import { n as WHATSAPP_LEGACY_OUTBOUND_SEND_DEP_KEYS } from "./outbound-base-E84SMkd9.js";
+import { t as whatsappCommandPolicy } from "./command-policy-BIOSHySD.js";
+import { a as resolveWhatsAppGroupRequireMention, o as resolveWhatsAppGroupToolPolicy, s as resolveWhatsAppGroupIntroHint } from "./setup-core-Dm1hsI3r.js";
+import "./config-schema-CsNDlDpL.js";
+import { t as whatsappSetupPlugin } from "./channel.setup-BDH3Mk5M.js";
+import { t as DEFAULT_WEB_MEDIA_BYTES } from "./constants-HU41RHGI.js";
+import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-CfLFAK54.js";
+import { n as testing } from "./access-control-p_vcYDW7.js";
+import { p as extractText, t as createWebSendApi } from "./send-api-CXPUXbUL.js";
+import { r as waitForWaConnection, t as createWaSocket } from "./session-CPsgRMMa.js";
 import "openclaw/plugin-sdk/channel-actions";
 import "openclaw/plugin-sdk/account-resolution";
 import "openclaw/plugin-sdk/core";

package/dist/auth-presence.js

@@ -1,4 +1,4 @@
-import { t as hasWebCredsSync } from "./creds-files-_2V8jzQa.js";
+import { r as hasWebCredsSync } from "./creds-files-B1kSWtBg.js";
 import fs from "node:fs";
 import path from "node:path";
 import { resolveOAuthDir } from "openclaw/plugin-sdk/state-paths";

package/dist/{auth-store-BLGYDyCH.js → auth-store-GTQvJznL.js}

@@ -1,32 +1,42 @@
-import { t as __exportAll } from "./rolldown-runtime-CiIaOW0V.js";
-import { n as resolveWebCredsBackupPath, r as resolveWebCredsPath } from "./creds-files-_2V8jzQa.js";
-import { r as resolveUserPath } from "./text-runtime-DyR0XOJ4.js";
-import { c as resolveComparableIdentity } from "./identity-CVFJuB0Q.js";
-import fs from "node:fs";
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
+import { a as readWebCredsJsonRawSync, c as statWebCredsFileSync, i as readWebCredsJsonRaw, o as resolveWebCredsBackupPath, s as resolveWebCredsPath, t as assertWebCredsPathRegularFileOrMissing } from "./creds-files-B1kSWtBg.js";
+import { r as resolveUserPath } from "./text-runtime-Dk37KYHj.js";
+import { c as resolveComparableIdentity } from "./identity-xoLLdqEv.js";
 import path from "node:path";
 import { resolveOAuthDir as resolveOAuthDir$1 } from "openclaw/plugin-sdk/state-paths";
+import { replaceFileAtomic } from "openclaw/plugin-sdk/security-runtime";
 import { formatCliCommand } from "openclaw/plugin-sdk/cli-runtime";
 import { defaultRuntime, getChildLogger, info, success } from "openclaw/plugin-sdk/runtime-env";
-import { replaceFileAtomic } from "openclaw/plugin-sdk/security-runtime";
-import fs$1 from "node:fs/promises";
+import fs from "node:fs/promises";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/routing";
 //#region extensions/whatsapp/src/creds-persistence.ts
 const CREDS_FILE_MODE = 384;
 const CREDS_SAVE_FLUSH_TIMEOUT_MS = 15e3;
 const credsSaveQueues = /* @__PURE__ */ new Map();
 async function stringifyCreds(creds) {
-	const { BufferJSON } = await import("./session.runtime-BxyATGX0.js").then((n) => n.a);
+	const { BufferJSON } = await import("./session.runtime-C6uBkEaI.js").then((n) => n.a);
 	return JSON.stringify(creds, BufferJSON.replacer);
 }
-async function writeCredsJsonAtomically(authDir, creds) {
+async function writeWebCredsRawAtomically(params) {
+	await assertWebCredsPathRegularFileOrMissing(params.filePath);
 	await replaceFileAtomic({
-		filePath: resolveWebCredsPath(authDir),
-		content: await stringifyCreds(creds),
+		filePath: params.filePath,
+		content: params.content,
 		dirMode: 448,
 		mode: CREDS_FILE_MODE,
-		tempPrefix: ".creds",
+		tempPrefix: params.tempPrefix,
 		syncTempFile: true,
-		syncParentDir: true
+		syncParentDir: true,
+		beforeRename: async ({ filePath }) => {
+			await assertWebCredsPathRegularFileOrMissing(filePath);
+		}
+	});
+}
+async function writeCredsJsonAtomically(authDir, creds) {
+	await writeWebCredsRawAtomically({
+		filePath: resolveWebCredsPath(authDir),
+		content: await stringifyCreds(creds),
+		tempPrefix: ".creds"
 	});
 }
 function enqueueCredsSave(authDir, saveCreds, onError) {
@@ -94,14 +104,7 @@ function resolveDefaultWebAuthDir() {
 }
 const WA_WEB_AUTH_DIR = resolveDefaultWebAuthDir();
 function readCredsJsonRaw(filePath) {
-	try {
-		if (!fs.existsSync(filePath)) return null;
-		const stats = fs.statSync(filePath);
-		if (!stats.isFile() || stats.size <= 1) return null;
-		return fs.readFileSync(filePath, "utf-8");
-	} catch {
-		return null;
-	}
+	return readWebCredsJsonRawSync(filePath);
 }
 async function waitForWebAuthBarrier(authDir, context) {
 	const result = await waitForCredsSaveQueueWithTimeout(authDir);
@@ -116,6 +119,11 @@ async function restoreCredsFromBackupIfNeeded(authDir) {
 	try {
 		const credsPath = resolveWebCredsPath(authDir);
 		const backupPath = resolveWebCredsBackupPath(authDir);
+		try {
+			await assertWebCredsPathRegularFileOrMissing(credsPath);
+		} catch {
+			return false;
+		}
 		const raw = readCredsJsonRaw(credsPath);
 		if (raw) {
 			JSON.parse(raw);
@@ -123,13 +131,10 @@ async function restoreCredsFromBackupIfNeeded(authDir) {
 		}
 		const backupRaw = readCredsJsonRaw(backupPath);
 		if (!backupRaw) return false;
-		if (!(await fs$1.lstat(backupPath).catch(() => null))?.isFile()) return false;
 		JSON.parse(backupRaw);
-		await replaceFileAtomic({
+		await writeWebCredsRawAtomically({
 			filePath: credsPath,
 			content: backupRaw,
-			dirMode: 448,
-			mode: 384,
 			tempPrefix: ".creds.restore"
 		});
 		logger.warn({ credsPath }, "restored corrupted WhatsApp creds.json from backup");
@@ -138,17 +143,9 @@ async function restoreCredsFromBackupIfNeeded(authDir) {
 	return false;
 }
 async function webAuthExists(authDir = resolveDefaultWebAuthDir()) {
-	const resolvedAuthDir = resolveUserPath(authDir);
-	const credsPath = resolveWebCredsPath(resolvedAuthDir);
-	try {
-		await fs$1.access(resolvedAuthDir);
-	} catch {
-		return false;
-	}
+	const raw = await readWebCredsJsonRaw(resolveWebCredsPath(resolveUserPath(authDir)));
+	if (!raw) return false;
 	try {
-		const stats = await fs$1.stat(credsPath);
-		if (!stats.isFile() || stats.size <= 1) return false;
-		const raw = await fs$1.readFile(credsPath, "utf-8");
 		JSON.parse(raw);
 		return true;
 	} catch {
@@ -222,25 +219,25 @@ function isBaileysAuthFileName(name) {
 	return /^(app-state-sync|session|sender-key|pre-key)-/.test(name);
 }
 async function clearBaileysAuthFiles(authDir) {
-	const rootStats = await fs$1.lstat(authDir).catch(() => null);
+	const rootStats = await fs.lstat(authDir).catch(() => null);
 	if (!rootStats?.isDirectory() || rootStats.isSymbolicLink()) return;
-	const entries = await fs$1.readdir(authDir, { withFileTypes: true });
+	const entries = await fs.readdir(authDir, { withFileTypes: true });
 	await Promise.all(entries.map(async (entry) => {
 		if (!entry.isFile()) return;
 		if (!isBaileysAuthFileName(entry.name)) return;
-		await fs$1.rm(path.join(authDir, entry.name), { force: true });
+		await fs.rm(path.join(authDir, entry.name), { force: true });
 	}));
 }
 async function shouldClearOnLogout(authDir, isLegacyAuthDir) {
 	try {
-		const stats = await fs$1.lstat(authDir);
+		const stats = await fs.lstat(authDir);
 		if (!stats.isDirectory() || stats.isSymbolicLink()) return false;
-		if (isLegacyAuthDir) return (await fs$1.readdir(authDir, { withFileTypes: true })).some((entry) => {
+		if (isLegacyAuthDir) return (await fs.readdir(authDir, { withFileTypes: true })).some((entry) => {
 			if (!entry.isFile()) return false;
 			return isBaileysAuthFileName(entry.name);
 		});
-		if ((await fs$1.lstat(resolveWebCredsPath(authDir)).catch(() => null))?.isFile()) return true;
-		return (await fs$1.lstat(resolveWebCredsBackupPath(authDir)).catch(() => null))?.isFile() === true;
+		if ((await fs.lstat(resolveWebCredsPath(authDir)).catch(() => null))?.isFile()) return true;
+		return (await fs.lstat(resolveWebCredsBackupPath(authDir)).catch(() => null))?.isFile() === true;
 	} catch (error) {
 		const codeValue = error && typeof error === "object" && "code" in error ? error.code : void 0;
 		return (typeof codeValue === "string" ? codeValue : "") !== "ENOENT";
@@ -255,7 +252,7 @@ async function pathHasSymlinkComponent(baseDir, targetPath) {
 	let currentPath = baseDir;
 	for (const segment of relativePath.split(path.sep)) {
 		currentPath = path.join(currentPath, segment);
-		const stats = await fs$1.lstat(currentPath).catch(() => null);
+		const stats = await fs.lstat(currentPath).catch(() => null);
 		if (!stats || stats.isSymbolicLink()) return true;
 	}
 	return false;
@@ -264,14 +261,14 @@ async function isLegacyWebAuthDir(authDir) {
 	const legacyAuthDir = path.resolve(resolveOAuthDir$1());
 	const resolvedAuthDir = path.resolve(authDir);
 	if (resolvedAuthDir !== legacyAuthDir) return false;
-	const stats = await fs$1.lstat(resolvedAuthDir).catch(() => null);
+	const stats = await fs.lstat(resolvedAuthDir).catch(() => null);
 	return stats?.isDirectory() === true && !stats.isSymbolicLink();
 }
 async function classifyWebAuthDirOwnership(authDir) {
 	const whatsappAuthBase = path.resolve(resolveOAuthDir$1(), "whatsapp");
 	const resolvedAuthDir = path.resolve(authDir);
 	if (!isPathInsideDirectory(whatsappAuthBase, resolvedAuthDir)) return { kind: "external" };
-	const [baseRealPath, authDirRealPath] = await Promise.all([fs$1.realpath(whatsappAuthBase).catch(() => null), fs$1.realpath(resolvedAuthDir).catch(() => null)]);
+	const [baseRealPath, authDirRealPath] = await Promise.all([fs.realpath(whatsappAuthBase).catch(() => null), fs.realpath(resolvedAuthDir).catch(() => null)]);
 	if (!baseRealPath || !authDirRealPath) return { kind: "unsafe-owned" };
 	if (!isPathInsideDirectory(baseRealPath, authDirRealPath)) return { kind: "unsafe-owned" };
 	if (await pathHasSymlinkComponent(whatsappAuthBase, resolvedAuthDir)) return { kind: "unsafe-owned" };
@@ -296,7 +293,7 @@ async function logoutWeb(params) {
 		await clearBaileysAuthFiles(resolvedAuthDir);
 	} else {
 		const ownership = await classifyWebAuthDirOwnership(resolvedAuthDir);
-		if (ownership.kind === "owned") await fs$1.rm(ownership.authDir, {
+		if (ownership.kind === "owned") await fs.rm(ownership.authDir, {
 			recursive: true,
 			force: true
 		});
@@ -313,9 +310,8 @@ async function logoutWeb(params) {
 }
 function readWebSelfId(authDir = resolveDefaultWebAuthDir()) {
 	try {
-		const credsPath = resolveWebCredsPath(resolveUserPath(authDir));
-		if (!fs.existsSync(credsPath)) return emptyWebSelfId();
-		const raw = fs.readFileSync(credsPath, "utf-8");
+		const raw = readCredsJsonRaw(resolveWebCredsPath(resolveUserPath(authDir)));
+		if (!raw) return emptyWebSelfId();
 		const parsed = JSON.parse(raw);
 		const identity = resolveComparableIdentity({
 			jid: parsed?.me?.id ?? null,
@@ -332,19 +328,18 @@ function readWebSelfId(authDir = resolveDefaultWebAuthDir()) {
 }
 async function readWebSelfIdentity(authDir = resolveDefaultWebAuthDir(), fallback) {
 	const resolvedAuthDir = resolveUserPath(authDir);
-	try {
-		const raw = await fs$1.readFile(resolveWebCredsPath(resolvedAuthDir), "utf-8");
+	const raw = await readWebCredsJsonRaw(resolveWebCredsPath(resolvedAuthDir));
+	if (raw) try {
 		const parsed = JSON.parse(raw);
 		return resolveComparableIdentity({
 			jid: parsed?.me?.id ?? null,
 			lid: parsed?.me?.lid ?? null
 		}, resolvedAuthDir);
-	} catch {
-		return resolveComparableIdentity({
-			jid: fallback?.id ?? null,
-			lid: fallback?.lid ?? null
-		}, resolvedAuthDir);
-	}
+	} catch {}
+	return resolveComparableIdentity({
+		jid: fallback?.id ?? null,
+		lid: fallback?.lid ?? null
+	}, resolvedAuthDir);
 }
 async function readWebSelfIdentityForDecision(authDir = resolveDefaultWebAuthDir(), fallback) {
 	const resolvedAuthDir = resolveUserPath(authDir);
@@ -359,12 +354,8 @@ async function readWebSelfIdentityForDecision(authDir = resolveDefaultWebAuthDir
 * Helpful for heartbeats/observability to spot stale credentials.
 */
 function getWebAuthAgeMs(authDir = resolveDefaultWebAuthDir()) {
-	try {
-		const stats = fs.statSync(resolveWebCredsPath(resolveUserPath(authDir)));
-		return Date.now() - stats.mtimeMs;
-	} catch {
-		return null;
-	}
+	const stats = statWebCredsFileSync(resolveWebCredsPath(resolveUserPath(authDir)));
+	return stats ? Math.max(0, Date.now() - stats.mtimeMs) : null;
 }
 function logWebSelfId(authDir = resolveDefaultWebAuthDir(), runtime = defaultRuntime, includeChannelPrefix = false) {
 	const { e164, jid, lid } = readWebSelfId(authDir);
@@ -381,4 +372,4 @@ async function pickWebChannel(pref, authDir = resolveDefaultWebAuthDir()) {
 	return choice;
 }
 //#endregion
-export { waitForCredsSaveQueue as C, enqueueCredsSave as S, writeCredsJsonAtomically as T, readWebSelfIdentity as _, formatWhatsAppWebAuthStatusState as a, restoreCredsFromBackupIfNeeded as b, logoutWeb as c, readWebAuthExistsBestEffort as d, readWebAuthExistsForDecision as f, readWebSelfId as g, readWebAuthState as h, auth_store_exports as i, pickWebChannel as l, readWebAuthSnapshotBestEffort as m, WHATSAPP_AUTH_UNSTABLE_CODE as n, getWebAuthAgeMs as o, readWebAuthSnapshot as p, WhatsAppAuthUnstableError as r, logWebSelfId as s, WA_WEB_AUTH_DIR as t, readCredsJsonRaw as u, readWebSelfIdentityForDecision as v, waitForCredsSaveQueueWithTimeout as w, webAuthExists as x, resolveDefaultWebAuthDir as y };
+export { waitForCredsSaveQueue as C, writeWebCredsRawAtomically as E, enqueueCredsSave as S, writeCredsJsonAtomically as T, readWebSelfIdentity as _, formatWhatsAppWebAuthStatusState as a, restoreCredsFromBackupIfNeeded as b, logoutWeb as c, readWebAuthExistsBestEffort as d, readWebAuthExistsForDecision as f, readWebSelfId as g, readWebAuthState as h, auth_store_exports as i, pickWebChannel as l, readWebAuthSnapshotBestEffort as m, WHATSAPP_AUTH_UNSTABLE_CODE as n, getWebAuthAgeMs as o, readWebAuthSnapshot as p, WhatsAppAuthUnstableError as r, logWebSelfId as s, WA_WEB_AUTH_DIR as t, readCredsJsonRaw as u, readWebSelfIdentityForDecision as v, waitForCredsSaveQueueWithTimeout as w, webAuthExists as x, resolveDefaultWebAuthDir as y };

package/dist/{channel-CHsR8MoG.js → channel-BVMD1oZL.js}

@@ -1,18 +1,18 @@
-import { t as listAccountIds } from "./account-ids-DgtV_RiP.js";
-import { a as resolveWhatsAppAccount } from "./accounts-CJNZl-3e.js";
-import { c as normalizeWhatsAppTarget, i as looksLikeWhatsAppTargetId, n as isWhatsAppNewsletterJid, o as normalizeWhatsAppAllowFromEntry, s as normalizeWhatsAppMessagingTarget, t as isWhatsAppGroupJid } from "./normalize-target-MB6Z_4Bn.js";
-import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-Ba7sH80H.js";
-import { t as resolveWhatsAppReactionLevel } from "./reaction-level-DeO7ktWb.js";
-import { r as normalizeWhatsAppPayloadTextPreservingIndentation } from "./outbound-media-contract-ItL7G0Az.js";
-import "./normalize-LMXvL6w0.js";
-import { i as sendTypingWhatsApp, n as sendPollWhatsApp, t as sendMessageWhatsApp } from "./send-BtGELs96.js";
-import { t as createWhatsAppLoginTool } from "./agent-tools-login-DpRxLNRB.js";
-import { t as createWhatsAppOutboundBase } from "./outbound-base-ARCS45ql.js";
-import { t as getWhatsAppRuntime } from "./runtime-6fZ67abR.js";
-import { t as whatsappCommandPolicy } from "./command-policy-O8sRnqUV.js";
-import { a as resolveWhatsAppGroupRequireMention, c as resolveWhatsAppMentionStripRegexes, i as whatsappSetupWizardProxy, l as formatWhatsAppConfigAllowFromEntries, n as createWhatsAppPluginBase, o as resolveWhatsAppGroupToolPolicy, r as loadWhatsAppChannelRuntime, s as resolveWhatsAppGroupIntroHint, t as whatsappSetupAdapter } from "./setup-core-P6dnz4Ur.js";
-import { f as readWebAuthExistsForDecision, n as WHATSAPP_AUTH_UNSTABLE_CODE } from "./auth-store-BLGYDyCH.js";
-import { t as detectWhatsAppLegacyStateMigrations } from "./state-migrations-CtdIArlK.js";
+import { t as listAccountIds } from "./account-ids-CB5SOWjc.js";
+import { a as resolveWhatsAppAccount } from "./accounts-BPYgj8Fv.js";
+import { c as normalizeWhatsAppTarget, i as looksLikeWhatsAppTargetId, n as isWhatsAppNewsletterJid, o as normalizeWhatsAppAllowFromEntry, s as normalizeWhatsAppMessagingTarget, t as isWhatsAppGroupJid } from "./normalize-target-bVWjgftN.js";
+import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-CV-iBmSG.js";
+import { t as resolveWhatsAppReactionLevel } from "./reaction-level-BqMOEBeq.js";
+import { r as normalizeWhatsAppPayloadTextPreservingIndentation } from "./outbound-media-contract-ioTkt8tn.js";
+import "./normalize-Bxwqo-bW.js";
+import { i as sendTypingWhatsApp, n as sendPollWhatsApp, t as sendMessageWhatsApp } from "./send-E_kMiuZP.js";
+import { t as createWhatsAppLoginTool } from "./agent-tools-login-BDzvb3ee.js";
+import { t as createWhatsAppOutboundBase } from "./outbound-base-E84SMkd9.js";
+import { t as getWhatsAppRuntime } from "./runtime-CboC4QhQ.js";
+import { t as whatsappCommandPolicy } from "./command-policy-BIOSHySD.js";
+import { a as resolveWhatsAppGroupRequireMention, c as resolveWhatsAppMentionStripRegexes, i as whatsappSetupWizardProxy, l as formatWhatsAppConfigAllowFromEntries, n as createWhatsAppPluginBase, o as resolveWhatsAppGroupToolPolicy, r as loadWhatsAppChannelRuntime, s as resolveWhatsAppGroupIntroHint, t as whatsappSetupAdapter } from "./setup-core-Dm1hsI3r.js";
+import { f as readWebAuthExistsForDecision, n as WHATSAPP_AUTH_UNSTABLE_CODE } from "./auth-store-GTQvJznL.js";
+import { t as detectWhatsAppLegacyStateMigrations } from "./state-migrations-D_BmQUR9.js";
 import { createActionGate as createActionGate$1 } from "openclaw/plugin-sdk/channel-actions";
 import { asString, collectIssuesForEnabledAccounts, createAsyncComputedAccountStatusAdapter, createDefaultChannelRuntimeState, isRecord } from "openclaw/plugin-sdk/status-helpers";
 import { formatCliCommand } from "openclaw/plugin-sdk/cli-runtime";
@@ -322,8 +322,8 @@ function collectWhatsAppStatusIssues(accounts) {
 }
 //#endregion
 //#region extensions/whatsapp/src/channel.ts
-const loadWhatsAppDirectoryConfig = createLazyRuntimeModule(() => import("./directory-config-QH8Oe8bc.js").then((n) => n.t));
-const loadWhatsAppChannelReactAction = createLazyRuntimeModule(() => import("./channel-react-action-6n63NhGY.js"));
+const loadWhatsAppDirectoryConfig = createLazyRuntimeModule(() => import("./directory-config-CfLFAK54.js").then((n) => n.t));
+const loadWhatsAppChannelReactAction = createLazyRuntimeModule(() => import("./channel-react-action-CHdR3gbn.js"));
 function parseWhatsAppExplicitTarget(raw) {
 	const normalized = normalizeWhatsAppTarget(raw);
 	if (!normalized) return null;

package/dist/channel-config-api.js

@@ -1,2 +1,2 @@
-import { t as WhatsAppChannelConfigSchema } from "./config-schema-Dmo66Ubb.js";
+import { t as WhatsAppChannelConfigSchema } from "./config-schema-CsNDlDpL.js";
 export { WhatsAppChannelConfigSchema };

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as whatsappPlugin } from "./channel-CHsR8MoG.js";
+import { t as whatsappPlugin } from "./channel-BVMD1oZL.js";
 export { whatsappPlugin };

package/dist/{channel-react-action-6n63NhGY.js → channel-react-action-CHdR3gbn.js}

@@ -1,8 +1,8 @@
-import { a as resolveWhatsAppAccount, s as resolveWhatsAppMediaMaxBytes } from "./accounts-CJNZl-3e.js";
-import { c as normalizeWhatsAppTarget, t as isWhatsAppGroupJid } from "./normalize-target-MB6Z_4Bn.js";
-import { r as resolveAuthorizedWhatsAppOutboundTarget, t as handleWhatsAppAction } from "./action-runtime-cZLWNUXF.js";
-import "./normalize-LMXvL6w0.js";
-import { t as sendMessageWhatsApp } from "./send-BtGELs96.js";
+import { a as resolveWhatsAppAccount, s as resolveWhatsAppMediaMaxBytes } from "./accounts-BPYgj8Fv.js";
+import { c as normalizeWhatsAppTarget, t as isWhatsAppGroupJid } from "./normalize-target-bVWjgftN.js";
+import { r as resolveAuthorizedWhatsAppOutboundTarget, t as handleWhatsAppAction } from "./action-runtime-D4UqEXqf.js";
+import "./normalize-Bxwqo-bW.js";
+import { t as sendMessageWhatsApp } from "./send-E_kMiuZP.js";
 import { jsonResult, readStringOrNumberParam, readStringParam as readStringParam$1, resolveReactionMessageId } from "openclaw/plugin-sdk/channel-actions";
 //#region extensions/whatsapp/src/channel-react-action.ts
 const WHATSAPP_CHANNEL = "whatsapp";

package/dist/{channel.runtime-n14SNsjm.js → channel.runtime-BBPZSziE.js}

@@ -1,9 +1,9 @@
 import { startWebLoginWithQr as startWebLoginWithQr$1, waitForWebLogin as waitForWebLogin$1 } from "./login-qr-runtime.js";
-import { c as logoutWeb$1, d as readWebAuthExistsBestEffort$1, f as readWebAuthExistsForDecision$1, g as readWebSelfId$1, h as readWebAuthState$1, m as readWebAuthSnapshotBestEffort$1, o as getWebAuthAgeMs$1, p as readWebAuthSnapshot$1, s as logWebSelfId$1, x as webAuthExists$1 } from "./auth-store-BLGYDyCH.js";
-import { t as getActiveWebListener$1 } from "./active-listener-C4ClVut4.js";
-import { t as monitorWebChannel$1 } from "./monitor-oXSnOpto.js";
-import { t as loginWeb$1 } from "./login-DJYp3l4Z.js";
-import { whatsappSetupWizard as whatsappSetupWizard$1 } from "./setup-surface-Bq3gnUCD.js";
+import { c as logoutWeb$1, d as readWebAuthExistsBestEffort$1, f as readWebAuthExistsForDecision$1, g as readWebSelfId$1, h as readWebAuthState$1, m as readWebAuthSnapshotBestEffort$1, o as getWebAuthAgeMs$1, p as readWebAuthSnapshot$1, s as logWebSelfId$1, x as webAuthExists$1 } from "./auth-store-GTQvJznL.js";
+import { t as getActiveWebListener$1 } from "./active-listener-B4SDebQ6.js";
+import { t as monitorWebChannel$1 } from "./monitor-Dw2i5QSQ.js";
+import { t as loginWeb$1 } from "./login-nJwaNuC-.js";
+import { whatsappSetupWizard as whatsappSetupWizard$1 } from "./setup-surface-DqY0LqAY.js";
 //#region extensions/whatsapp/src/channel.runtime.ts
 function getActiveWebListener(...args) {
 	return getActiveWebListener$1(...args);

package/dist/{channel.setup-BiuhxbjG.js → channel.setup-BDH3Mk5M.js}

@@ -1,8 +1,8 @@
-import { a as resolveWhatsAppGroupRequireMention, i as whatsappSetupWizardProxy, n as createWhatsAppPluginBase, o as resolveWhatsAppGroupToolPolicy, s as resolveWhatsAppGroupIntroHint, t as whatsappSetupAdapter } from "./setup-core-P6dnz4Ur.js";
-import { t as detectWhatsAppLegacyStateMigrations } from "./state-migrations-CtdIArlK.js";
+import { a as resolveWhatsAppGroupRequireMention, i as whatsappSetupWizardProxy, n as createWhatsAppPluginBase, o as resolveWhatsAppGroupToolPolicy, s as resolveWhatsAppGroupIntroHint, t as whatsappSetupAdapter } from "./setup-core-Dm1hsI3r.js";
+import { t as detectWhatsAppLegacyStateMigrations } from "./state-migrations-D_BmQUR9.js";
 //#region extensions/whatsapp/src/channel.setup.ts
 async function isWhatsAppAuthConfigured(account) {
-	const { readWebAuthState } = await import("./auth-store-BLGYDyCH.js").then((n) => n.i);
+	const { readWebAuthState } = await import("./auth-store-GTQvJznL.js").then((n) => n.i);
 	return await readWebAuthState(account.authDir) === "linked";
 }
 const whatsappSetupPlugin = {

package/dist/{connection-controller-Cq6sY2mA.js → connection-controller-9TXWZRhx.js}

@@ -1,7 +1,7 @@
-import { n as registerWhatsAppConnectionController, r as unregisterWhatsAppConnectionController } from "./connection-controller-registry-D_iIGz5m.js";
-import { n as getStatusCode, t as formatError } from "./session-errors-KYQIoX8M.js";
-import { c as logoutWeb } from "./auth-store-BLGYDyCH.js";
-import { r as waitForWaConnection, t as createWaSocket } from "./session-DqDc1usL.js";
+import { n as registerWhatsAppConnectionController, r as unregisterWhatsAppConnectionController } from "./connection-controller-registry-TSX_udJp.js";
+import { n as getStatusCode, t as formatError } from "./session-errors-BAj9D2La.js";
+import { c as logoutWeb } from "./auth-store-GTQvJznL.js";
+import { r as waitForWaConnection, t as createWaSocket } from "./session-CPsgRMMa.js";
 import { computeBackoff, info, sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
 import { clamp } from "openclaw/plugin-sdk/text-utility-runtime";
 import { DisconnectReason } from "baileys";

package/dist/constants.js

@@ -1,2 +1,2 @@
-import { t as DEFAULT_WEB_MEDIA_BYTES } from "./constants-yKXGCGU9.js";
+import { t as DEFAULT_WEB_MEDIA_BYTES } from "./constants-HU41RHGI.js";
 export { DEFAULT_WEB_MEDIA_BYTES };

package/dist/contract-api.js

@@ -1,11 +1,11 @@
-import { c as normalizeWhatsAppTarget$1, t as isWhatsAppGroupJid$1 } from "./normalize-target-MB6Z_4Bn.js";
-import { t as whatsappCommandPolicy$1 } from "./command-policy-O8sRnqUV.js";
-import { t as resolveLegacyGroupSessionKey$1 } from "./group-session-contract-DdqigLJl.js";
-import { n as unsupportedSecretRefSurfacePatterns, t as collectUnsupportedSecretRefConfigCandidates } from "./security-contract-CvfWex9e.js";
-import { r as isLegacyGroupSessionKey$1, t as canonicalizeLegacySessionKey$1 } from "./session-contract-B0efQf9P.js";
-import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-QH8Oe8bc.js";
-import { t as resolveWhatsAppRuntimeGroupPolicy$1 } from "./runtime-group-policy-BH_U23qp.js";
-import { n as testing } from "./access-control-Blo69-dW.js";
+import { c as normalizeWhatsAppTarget$1, t as isWhatsAppGroupJid$1 } from "./normalize-target-bVWjgftN.js";
+import { t as whatsappCommandPolicy$1 } from "./command-policy-BIOSHySD.js";
+import { t as resolveLegacyGroupSessionKey$1 } from "./group-session-contract-DDnZSsJ1.js";
+import { n as unsupportedSecretRefSurfacePatterns, t as collectUnsupportedSecretRefConfigCandidates } from "./security-contract-nAzD945y.js";
+import { r as isLegacyGroupSessionKey$1, t as canonicalizeLegacySessionKey$1 } from "./session-contract-DMTm6Q_L.js";
+import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-CfLFAK54.js";
+import { t as resolveWhatsAppRuntimeGroupPolicy$1 } from "./runtime-group-policy-DeSRFXEV.js";
+import { n as testing } from "./access-control-p_vcYDW7.js";
 //#region extensions/whatsapp/contract-api.ts
 const canonicalizeLegacySessionKey = canonicalizeLegacySessionKey$1;
 const isLegacyGroupSessionKey = isLegacyGroupSessionKey$1;

package/dist/creds-files-B1kSWtBg.js

@@ -0,0 +1,79 @@
+import path from "node:path";
+import { assertNoSymlinkParents, assertNoSymlinkParentsSync, readRegularFile, readRegularFileSync, statRegularFile, statRegularFileSync } from "openclaw/plugin-sdk/security-runtime";
+//#region extensions/whatsapp/src/creds-files.ts
+function resolveWebCredsPath(authDir) {
+	return path.join(authDir, "creds.json");
+}
+function resolveWebCredsBackupPath(authDir) {
+	return path.join(authDir, "creds.json.bak");
+}
+function resolveWebCredsParentCheck(filePath) {
+	const dir = path.resolve(path.dirname(filePath));
+	return {
+		rootDir: path.parse(dir).root,
+		targetPath: dir,
+		allowMissing: true,
+		allowRootChildSymlink: true,
+		requireDirectories: true,
+		messagePrefix: "WhatsApp credential file path"
+	};
+}
+async function assertWebCredsParentPathSafe(filePath) {
+	await assertNoSymlinkParents(resolveWebCredsParentCheck(filePath));
+}
+function assertWebCredsParentPathSafeSync(filePath) {
+	assertNoSymlinkParentsSync(resolveWebCredsParentCheck(filePath));
+}
+async function assertWebCredsPathRegularFileOrMissing(filePath) {
+	try {
+		await assertWebCredsParentPathSafe(filePath);
+		await statRegularFile(filePath);
+	} catch (error) {
+		throw new Error(`WhatsApp credential file path is unsafe; creds.json must be a regular file or missing: ${filePath}`, { cause: error });
+	}
+}
+function readWebCredsJsonRawSync(filePath) {
+	try {
+		assertWebCredsParentPathSafeSync(filePath);
+		const { buffer, stat } = readRegularFileSync({ filePath });
+		return stat.size > 1 ? buffer.toString("utf-8") : null;
+	} catch {
+		return null;
+	}
+}
+async function readWebCredsJsonRaw(filePath) {
+	try {
+		await assertWebCredsParentPathSafe(filePath);
+		const { buffer, stat } = await readRegularFile({ filePath });
+		return stat.size > 1 ? buffer.toString("utf-8") : null;
+	} catch {
+		return null;
+	}
+}
+function statWebCredsFileSync(filePath) {
+	try {
+		assertWebCredsParentPathSafeSync(filePath);
+		const result = statRegularFileSync(filePath);
+		if (result.missing || result.stat.size <= 1) return null;
+		return {
+			mtimeMs: result.stat.mtimeMs,
+			size: result.stat.size
+		};
+	} catch {
+		return null;
+	}
+}
+function hasWebCredsRegularFileSync(authDir) {
+	try {
+		const credsPath = resolveWebCredsPath(authDir);
+		assertWebCredsParentPathSafeSync(credsPath);
+		return !statRegularFileSync(credsPath).missing;
+	} catch {
+		return false;
+	}
+}
+function hasWebCredsSync(authDir) {
+	return statWebCredsFileSync(resolveWebCredsPath(authDir)) !== null;
+}
+//#endregion
+export { readWebCredsJsonRawSync as a, statWebCredsFileSync as c, readWebCredsJsonRaw as i, hasWebCredsRegularFileSync as n, resolveWebCredsBackupPath as o, hasWebCredsSync as r, resolveWebCredsPath as s, assertWebCredsPathRegularFileOrMissing as t };

package/dist/{directory-config-QH8Oe8bc.js → directory-config-CfLFAK54.js}

@@ -1,7 +1,7 @@
-import { t as __exportAll } from "./rolldown-runtime-CiIaOW0V.js";
-import { t as resolveMergedWhatsAppAccountConfig } from "./account-config-D3OXPtpW.js";
-import { c as normalizeWhatsAppTarget, t as isWhatsAppGroupJid } from "./normalize-target-MB6Z_4Bn.js";
-import "./normalize-LMXvL6w0.js";
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
+import { t as resolveMergedWhatsAppAccountConfig } from "./account-config-Bxl16soz.js";
+import { c as normalizeWhatsAppTarget, t as isWhatsAppGroupJid } from "./normalize-target-bVWjgftN.js";
+import "./normalize-Bxwqo-bW.js";
 import { listResolvedDirectoryGroupEntriesFromMapKeys, listResolvedDirectoryUserEntriesFromAllowFrom } from "openclaw/plugin-sdk/directory-config-runtime";
 //#region extensions/whatsapp/src/directory-config.ts
 var directory_config_exports = /* @__PURE__ */ __exportAll({

package/dist/directory-contract-api.js

@@ -1,2 +1,2 @@
-import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-QH8Oe8bc.js";
+import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-CfLFAK54.js";
 export { listWhatsAppDirectoryGroupsFromConfig, listWhatsAppDirectoryPeersFromConfig };