@openclaw/whatsapp 2026.5.2-beta.2 → 2026.5.3-beta.1

package/src/resolve-outbound-target.test.ts

@@ -1,265 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import * as normalize from "./normalize-target.js";
-
-vi.mock("./normalize-target.js");
-vi.mock("openclaw/plugin-sdk/channel-feedback", () => ({
-  missingTargetError: (platform: string, format: string) => new Error(`${platform}: ${format}`),
-}));
-
-let resolveWhatsAppOutboundTarget: typeof import("./resolve-outbound-target.js").resolveWhatsAppOutboundTarget;
-
-type ResolveParams = Parameters<typeof resolveWhatsAppOutboundTarget>[0];
-const PRIMARY_TARGET = "+11234567890";
-const SECONDARY_TARGET = "+19876543210";
-
-function expectResolutionError(params: ResolveParams) {
-  const result = resolveWhatsAppOutboundTarget(params);
-  expect(result.ok).toBe(false);
-  if (result.ok) {
-    throw new Error("expected resolution to fail");
-  }
-  expect(result.error.message).toContain("WhatsApp");
-}
-
-function expectResolutionErrorMessage(params: ResolveParams, expectedMessage: string) {
-  const result = resolveWhatsAppOutboundTarget(params);
-  expect(result.ok).toBe(false);
-  if (result.ok) {
-    throw new Error("expected resolution to fail");
-  }
-  expect(result.error.message).toBe(expectedMessage);
-}
-
-function expectResolutionOk(params: ResolveParams, expectedTarget: string) {
-  const result = resolveWhatsAppOutboundTarget(params);
-  expect(result).toEqual({ ok: true, to: expectedTarget });
-}
-
-function mockNormalizedDirectMessage(...values: Array<string | null>) {
-  const normalizeMock = vi.mocked(normalize.normalizeWhatsAppTarget);
-  for (const value of values) {
-    normalizeMock.mockReturnValueOnce(value);
-  }
-  vi.mocked(normalize.isWhatsAppGroupJid).mockReturnValueOnce(false);
-}
-
-function expectAllowedForTarget(params: {
-  allowFrom: ResolveParams["allowFrom"];
-  mode: ResolveParams["mode"];
-  to?: string;
-}) {
-  const to = params.to ?? PRIMARY_TARGET;
-  expectResolutionOk(
-    {
-      to,
-      allowFrom: params.allowFrom,
-      mode: params.mode,
-    },
-    to,
-  );
-}
-
-function expectDeniedForTarget(params: {
-  allowFrom: ResolveParams["allowFrom"];
-  mode: ResolveParams["mode"];
-  to?: string;
-}) {
-  expectResolutionError({
-    to: params.to ?? PRIMARY_TARGET,
-    allowFrom: params.allowFrom,
-    mode: params.mode,
-  });
-}
-
-describe("resolveWhatsAppOutboundTarget", () => {
-  beforeEach(async () => {
-    vi.resetModules();
-    vi.resetAllMocks();
-    ({ resolveWhatsAppOutboundTarget } = await import("./resolve-outbound-target.js"));
-  });
-
-  describe("empty/missing to parameter", () => {
-    it.each([
-      ["null", null],
-      ["undefined", undefined],
-      ["empty string", ""],
-      ["whitespace only", "   "],
-    ])("returns error when to is %s", (_label, to) => {
-      expectResolutionError({ to, allowFrom: undefined, mode: undefined });
-    });
-  });
-
-  describe("normalization failures", () => {
-    it("returns error when normalizeWhatsAppTarget returns null/undefined", () => {
-      vi.mocked(normalize.normalizeWhatsAppTarget).mockReturnValueOnce(null);
-      expectResolutionError({
-        to: "+1234567890",
-        allowFrom: undefined,
-        mode: undefined,
-      });
-    });
-  });
-
-  describe("group JID handling", () => {
-    it("returns success for valid group JID regardless of mode", () => {
-      vi.mocked(normalize.normalizeWhatsAppTarget).mockReturnValueOnce("120363123456789@g.us");
-      vi.mocked(normalize.isWhatsAppGroupJid).mockReturnValueOnce(true);
-
-      expectResolutionOk(
-        {
-          to: "120363123456789@g.us",
-          allowFrom: undefined,
-          mode: "implicit",
-        },
-        "120363123456789@g.us",
-      );
-    });
-
-    it("returns success for group JID in heartbeat mode", () => {
-      vi.mocked(normalize.normalizeWhatsAppTarget).mockReturnValueOnce("120363999888777@g.us");
-      vi.mocked(normalize.isWhatsAppGroupJid).mockReturnValueOnce(true);
-
-      expectResolutionOk(
-        {
-          to: "120363999888777@g.us",
-          allowFrom: undefined,
-          mode: "heartbeat",
-        },
-        "120363999888777@g.us",
-      );
-    });
-  });
-
-  describe("implicit/heartbeat mode with allowList", () => {
-    it("allows message when wildcard is present", () => {
-      mockNormalizedDirectMessage(PRIMARY_TARGET, PRIMARY_TARGET);
-      expectAllowedForTarget({ allowFrom: ["*"], mode: "implicit" });
-    });
-
-    it("allows message when allowList is empty", () => {
-      mockNormalizedDirectMessage(PRIMARY_TARGET, PRIMARY_TARGET);
-      expectAllowedForTarget({ allowFrom: [], mode: "implicit" });
-    });
-
-    it("allows message when target is in allowList", () => {
-      mockNormalizedDirectMessage(PRIMARY_TARGET, PRIMARY_TARGET);
-      expectAllowedForTarget({ allowFrom: [PRIMARY_TARGET], mode: "implicit" });
-    });
-
-    it("denies message when target is not in allowList", () => {
-      mockNormalizedDirectMessage(PRIMARY_TARGET, SECONDARY_TARGET);
-      expectResolutionErrorMessage(
-        {
-          to: PRIMARY_TARGET,
-          allowFrom: [SECONDARY_TARGET],
-          mode: "implicit",
-        },
-        `Target "${SECONDARY_TARGET}" is not listed in the configured WhatsApp allowFrom policy.`,
-      );
-    });
-
-    it("uses the normalized target in the allowFrom error message", () => {
-      vi.mocked(normalize.normalizeWhatsAppTarget)
-        .mockReturnValueOnce(SECONDARY_TARGET)
-        .mockReturnValueOnce(PRIMARY_TARGET);
-      vi.mocked(normalize.isWhatsAppGroupJid).mockReturnValueOnce(false);
-
-      expectResolutionErrorMessage(
-        {
-          to: "(123) 456-7890",
-          allowFrom: [SECONDARY_TARGET],
-          mode: "implicit",
-        },
-        `Target "${PRIMARY_TARGET}" is not listed in the configured WhatsApp allowFrom policy.`,
-      );
-    });
-
-    it("handles mixed numeric and string allowList entries", () => {
-      vi.mocked(normalize.normalizeWhatsAppTarget)
-        .mockReturnValueOnce("+11234567890")
-        .mockReturnValueOnce("+11234567890")
-        .mockReturnValueOnce("+11234567890");
-      vi.mocked(normalize.isWhatsAppGroupJid).mockReturnValueOnce(false);
-
-      expectAllowedForTarget({
-        allowFrom: [1234567890, PRIMARY_TARGET],
-        mode: "implicit",
-      });
-    });
-
-    it("filters out invalid normalized entries from allowList", () => {
-      vi.mocked(normalize.normalizeWhatsAppTarget)
-        .mockReturnValueOnce(null)
-        .mockReturnValueOnce("+11234567890")
-        .mockReturnValueOnce("+11234567890");
-      vi.mocked(normalize.isWhatsAppGroupJid).mockReturnValueOnce(false);
-
-      expectAllowedForTarget({
-        allowFrom: ["invalid", PRIMARY_TARGET],
-        mode: "implicit",
-      });
-    });
-  });
-
-  describe("heartbeat mode", () => {
-    it("allows message when target is in allowList in heartbeat mode", () => {
-      mockNormalizedDirectMessage(PRIMARY_TARGET, PRIMARY_TARGET);
-      expectAllowedForTarget({ allowFrom: [PRIMARY_TARGET], mode: "heartbeat" });
-    });
-
-    it("denies message when target is not in allowList in heartbeat mode", () => {
-      mockNormalizedDirectMessage(PRIMARY_TARGET, SECONDARY_TARGET);
-      expectDeniedForTarget({ allowFrom: [SECONDARY_TARGET], mode: "heartbeat" });
-    });
-  });
-
-  describe("explicit/custom modes", () => {
-    it("allows message in null mode when allowList is not set", () => {
-      mockNormalizedDirectMessage(PRIMARY_TARGET);
-      expectAllowedForTarget({ allowFrom: undefined, mode: null });
-    });
-
-    it("allows message in undefined mode when allowList is not set", () => {
-      mockNormalizedDirectMessage(PRIMARY_TARGET);
-      expectAllowedForTarget({ allowFrom: undefined, mode: undefined });
-    });
-
-    it("enforces allowList in custom mode string", () => {
-      mockNormalizedDirectMessage(SECONDARY_TARGET, PRIMARY_TARGET);
-      expectDeniedForTarget({ allowFrom: [SECONDARY_TARGET], mode: "broadcast" });
-    });
-
-    it("allows message in custom mode string when target is in allowList", () => {
-      mockNormalizedDirectMessage(PRIMARY_TARGET, PRIMARY_TARGET);
-      expectAllowedForTarget({ allowFrom: [PRIMARY_TARGET], mode: "broadcast" });
-    });
-  });
-
-  describe("whitespace handling", () => {
-    it("trims whitespace from to parameter", () => {
-      mockNormalizedDirectMessage(PRIMARY_TARGET);
-
-      expectResolutionOk(
-        {
-          to: `  ${PRIMARY_TARGET}  `,
-          allowFrom: undefined,
-          mode: undefined,
-        },
-        PRIMARY_TARGET,
-      );
-      expect(vi.mocked(normalize.normalizeWhatsAppTarget)).toHaveBeenCalledWith(PRIMARY_TARGET);
-    });
-
-    it("trims whitespace from allowList entries", () => {
-      mockNormalizedDirectMessage(PRIMARY_TARGET, PRIMARY_TARGET);
-
-      resolveWhatsAppOutboundTarget({
-        to: PRIMARY_TARGET,
-        allowFrom: [`  ${PRIMARY_TARGET}  `],
-        mode: undefined,
-      });
-
-      expect(vi.mocked(normalize.normalizeWhatsAppTarget)).toHaveBeenCalledWith(PRIMARY_TARGET);
-    });
-  });
-});

package/src/resolve-outbound-target.ts

@@ -1,54 +0,0 @@
-import { missingTargetError } from "openclaw/plugin-sdk/channel-feedback";
-import { isWhatsAppGroupJid, normalizeWhatsAppTarget } from "./normalize-target.js";
-
-export type WhatsAppOutboundTargetResolution =
-  | { ok: true; to: string }
-  | { ok: false; error: Error };
-
-function whatsappAllowFromPolicyError(target: string): Error {
-  return new Error(`Target "${target}" is not listed in the configured WhatsApp allowFrom policy.`);
-}
-
-export function resolveWhatsAppOutboundTarget(params: {
-  to: string | null | undefined;
-  allowFrom: Array<string | number> | null | undefined;
-  mode: string | null | undefined;
-}): WhatsAppOutboundTargetResolution {
-  const trimmed = params.to?.trim() ?? "";
-  const allowListRaw = (params.allowFrom ?? [])
-    .map((entry) => String(entry).trim())
-    .filter(Boolean);
-  const hasWildcard = allowListRaw.includes("*");
-  const allowList = allowListRaw
-    .filter((entry) => entry !== "*")
-    .map((entry) => normalizeWhatsAppTarget(entry))
-    .filter((entry): entry is string => Boolean(entry));
-
-  if (trimmed) {
-    const normalizedTo = normalizeWhatsAppTarget(trimmed);
-    if (!normalizedTo) {
-      return {
-        ok: false,
-        error: missingTargetError("WhatsApp", "<E.164|group JID>"),
-      };
-    }
-    if (isWhatsAppGroupJid(normalizedTo)) {
-      return { ok: true, to: normalizedTo };
-    }
-    if (hasWildcard || allowList.length === 0) {
-      return { ok: true, to: normalizedTo };
-    }
-    if (allowList.includes(normalizedTo)) {
-      return { ok: true, to: normalizedTo };
-    }
-    return {
-      ok: false,
-      error: whatsappAllowFromPolicyError(normalizedTo),
-    };
-  }
-
-  return {
-    ok: false,
-    error: missingTargetError("WhatsApp", "<E.164|group JID>"),
-  };
-}

package/src/resolve-target.test.ts

@@ -1,97 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  isWhatsAppGroupJid,
-  looksLikeWhatsAppTargetId,
-  isWhatsAppUserTarget,
-  normalizeWhatsAppMessagingTarget,
-  normalizeWhatsAppTarget,
-} from "./normalize-target.js";
-
-describe("normalizeWhatsAppTarget", () => {
-  it("preserves group JIDs", () => {
-    expect(normalizeWhatsAppTarget("120363401234567890@g.us")).toBe("120363401234567890@g.us");
-    expect(normalizeWhatsAppTarget("123456789-987654321@g.us")).toBe("123456789-987654321@g.us");
-    expect(normalizeWhatsAppTarget("whatsapp:120363401234567890@g.us")).toBe(
-      "120363401234567890@g.us",
-    );
-  });
-
-  it("normalizes direct JIDs to E.164", () => {
-    expect(normalizeWhatsAppTarget("1555123@s.whatsapp.net")).toBe("+1555123");
-  });
-
-  it("normalizes user JIDs with device suffix to E.164", () => {
-    expect(normalizeWhatsAppTarget("41796666864:0@s.whatsapp.net")).toBe("+41796666864");
-    expect(normalizeWhatsAppTarget("1234567890:123@s.whatsapp.net")).toBe("+1234567890");
-    expect(normalizeWhatsAppTarget("41796666864@s.whatsapp.net")).toBe("+41796666864");
-  });
-
-  it("normalizes LID JIDs to E.164", () => {
-    expect(normalizeWhatsAppTarget("123456789@lid")).toBe("+123456789");
-    expect(normalizeWhatsAppTarget("123456789@LID")).toBe("+123456789");
-  });
-
-  it("rejects invalid targets", () => {
-    expect(normalizeWhatsAppTarget("wat")).toBeNull();
-    expect(normalizeWhatsAppTarget("whatsapp:")).toBeNull();
-    expect(normalizeWhatsAppTarget("@g.us")).toBeNull();
-    expect(normalizeWhatsAppTarget("whatsapp:group:@g.us")).toBeNull();
-    expect(normalizeWhatsAppTarget("whatsapp:group:120363401234567890@g.us")).toBeNull();
-    expect(normalizeWhatsAppTarget("group:123456789-987654321@g.us")).toBeNull();
-    expect(normalizeWhatsAppTarget(" WhatsApp:Group:123456789-987654321@G.US ")).toBeNull();
-    expect(normalizeWhatsAppTarget("abc@s.whatsapp.net")).toBeNull();
-  });
-
-  it("rejects non-WhatsApp provider-prefixed phone-like targets", () => {
-    expect(normalizeWhatsAppTarget("telegram:1234567890")).toBeNull();
-    expect(normalizeWhatsAppTarget("tg:1234567890")).toBeNull();
-    expect(normalizeWhatsAppTarget("sms:+15551234567")).toBeNull();
-    expect(looksLikeWhatsAppTargetId("telegram:1234567890")).toBe(false);
-  });
-
-  it("handles repeated prefixes", () => {
-    expect(normalizeWhatsAppTarget("whatsapp:whatsapp:+1555")).toBe("+1555");
-    expect(normalizeWhatsAppTarget("group:group:120@g.us")).toBeNull();
-  });
-});
-
-describe("isWhatsAppUserTarget", () => {
-  it("detects user JIDs with various formats", () => {
-    expect(isWhatsAppUserTarget("41796666864:0@s.whatsapp.net")).toBe(true);
-    expect(isWhatsAppUserTarget("1234567890@s.whatsapp.net")).toBe(true);
-    expect(isWhatsAppUserTarget("123456789@lid")).toBe(true);
-    expect(isWhatsAppUserTarget("123456789@LID")).toBe(true);
-    expect(isWhatsAppUserTarget("123@lid:0")).toBe(false);
-    expect(isWhatsAppUserTarget("abc@s.whatsapp.net")).toBe(false);
-    expect(isWhatsAppUserTarget("123456789-987654321@g.us")).toBe(false);
-    expect(isWhatsAppUserTarget("+1555123")).toBe(false);
-  });
-});
-
-describe("isWhatsAppGroupJid", () => {
-  it("detects group JIDs with or without prefixes", () => {
-    expect(isWhatsAppGroupJid("120363401234567890@g.us")).toBe(true);
-    expect(isWhatsAppGroupJid("123456789-987654321@g.us")).toBe(true);
-    expect(isWhatsAppGroupJid("whatsapp:120363401234567890@g.us")).toBe(true);
-    expect(isWhatsAppGroupJid("whatsapp:group:120363401234567890@g.us")).toBe(false);
-    expect(isWhatsAppGroupJid("x@g.us")).toBe(false);
-    expect(isWhatsAppGroupJid("@g.us")).toBe(false);
-    expect(isWhatsAppGroupJid("120@g.usx")).toBe(false);
-    expect(isWhatsAppGroupJid("+1555123")).toBe(false);
-  });
-});
-
-describe("normalizeWhatsAppMessagingTarget", () => {
-  it("normalizes blank inputs to undefined", () => {
-    expect(normalizeWhatsAppMessagingTarget("   ")).toBeUndefined();
-  });
-});
-
-describe("looksLikeWhatsAppTargetId", () => {
-  it("detects common WhatsApp target forms", () => {
-    expect(looksLikeWhatsAppTargetId("whatsapp:+15555550123")).toBe(true);
-    expect(looksLikeWhatsAppTargetId("15555550123@c.us")).toBe(true);
-    expect(looksLikeWhatsAppTargetId("+15555550123")).toBe(true);
-    expect(looksLikeWhatsAppTargetId("")).toBe(false);
-  });
-});

package/src/runtime-api.ts

@@ -1,59 +0,0 @@
-export { getChatChannelMeta, type ChannelPlugin } from "openclaw/plugin-sdk/core";
-export { buildChannelConfigSchema, WhatsAppConfigSchema } from "../config-api.js";
-export { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
-export {
-  formatWhatsAppConfigAllowFromEntries,
-  resolveWhatsAppConfigAllowFrom,
-  resolveWhatsAppConfigDefaultTo,
-} from "./config-accessors.js";
-export {
-  createActionGate,
-  jsonResult,
-  readReactionParams,
-  readStringParam,
-  ToolAuthorizationError,
-} from "openclaw/plugin-sdk/channel-actions";
-export { normalizeE164 } from "openclaw/plugin-sdk/account-resolution";
-export type { DmPolicy, GroupPolicy } from "openclaw/plugin-sdk/config-types";
-import type { OpenClawConfig as RuntimeOpenClawConfig } from "openclaw/plugin-sdk/config-types";
-
-export { type ChannelMessageActionName } from "openclaw/plugin-sdk/channel-contract";
-export { loadOutboundMediaFromUrl } from "./outbound-media.runtime.js";
-export {
-  resolveWhatsAppGroupRequireMention,
-  resolveWhatsAppGroupToolPolicy,
-} from "./group-policy.js";
-export {
-  resolveWhatsAppGroupIntroHint,
-  resolveWhatsAppMentionStripRegexes,
-} from "./group-intro.js";
-export { createWhatsAppOutboundBase } from "./outbound-base.js";
-export {
-  isWhatsAppGroupJid,
-  isWhatsAppUserTarget,
-  looksLikeWhatsAppTargetId,
-  normalizeWhatsAppAllowFromEntries,
-  normalizeWhatsAppMessagingTarget,
-  normalizeWhatsAppTarget,
-} from "./normalize-target.js";
-export { resolveWhatsAppOutboundTarget } from "./resolve-outbound-target.js";
-export { resolveWhatsAppReactionLevel } from "./reaction-level.js";
-
-export type OpenClawConfig = RuntimeOpenClawConfig;
-export type { WhatsAppAccountConfig } from "./account-types.js";
-
-type MonitorWebChannel = typeof import("./channel.runtime.js").monitorWebChannel;
-
-let channelRuntimePromise: Promise<typeof import("./channel.runtime.js")> | null = null;
-
-function loadChannelRuntime() {
-  channelRuntimePromise ??= import("./channel.runtime.js");
-  return channelRuntimePromise;
-}
-
-export async function monitorWebChannel(
-  ...args: Parameters<MonitorWebChannel>
-): ReturnType<MonitorWebChannel> {
-  const { monitorWebChannel } = await loadChannelRuntime();
-  return await monitorWebChannel(...args);
-}

package/src/runtime-group-policy.ts

@@ -1,16 +0,0 @@
-import { resolveOpenProviderRuntimeGroupPolicy } from "openclaw/plugin-sdk/runtime-group-policy";
-
-export function resolveWhatsAppRuntimeGroupPolicy(params: {
-  providerConfigPresent: boolean;
-  groupPolicy?: "open" | "allowlist" | "disabled";
-  defaultGroupPolicy?: "open" | "allowlist" | "disabled";
-}): {
-  groupPolicy: "open" | "allowlist" | "disabled";
-  providerMissingFallbackApplied: boolean;
-} {
-  return resolveOpenProviderRuntimeGroupPolicy({
-    providerConfigPresent: params.providerConfigPresent,
-    groupPolicy: params.groupPolicy,
-    defaultGroupPolicy: params.defaultGroupPolicy,
-  });
-}

package/src/runtime.ts

@@ -1,9 +0,0 @@
-import type { PluginRuntime } from "openclaw/plugin-sdk/core";
-import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
-
-const { setRuntime: setWhatsAppRuntime, getRuntime: getWhatsAppRuntime } =
-  createPluginRuntimeStore<PluginRuntime>({
-    pluginId: "whatsapp",
-    errorMessage: "WhatsApp runtime not initialized",
-  });
-export { getWhatsAppRuntime, setWhatsAppRuntime };

package/src/security-contract.ts

@@ -1,47 +0,0 @@
-import { isRecord } from "openclaw/plugin-sdk/text-runtime";
-
-type UnsupportedSecretRefConfigCandidate = {
-  path: string;
-  value: unknown;
-};
-
-export const unsupportedSecretRefSurfacePatterns = [
-  "channels.whatsapp.creds.json",
-  "channels.whatsapp.accounts.*.creds.json",
-] as const;
-
-export function collectUnsupportedSecretRefConfigCandidates(
-  raw: unknown,
-): UnsupportedSecretRefConfigCandidate[] {
-  if (!isRecord(raw)) {
-    return [];
-  }
-  if (!isRecord(raw.channels) || !isRecord(raw.channels.whatsapp)) {
-    return [];
-  }
-
-  const candidates: UnsupportedSecretRefConfigCandidate[] = [];
-  const whatsapp = raw.channels.whatsapp;
-  const creds = isRecord(whatsapp.creds) ? whatsapp.creds : null;
-  if (creds) {
-    candidates.push({
-      path: "channels.whatsapp.creds.json",
-      value: creds.json,
-    });
-  }
-
-  const accounts = isRecord(whatsapp.accounts) ? whatsapp.accounts : null;
-  if (!accounts) {
-    return candidates;
-  }
-  for (const [accountId, account] of Object.entries(accounts)) {
-    if (!isRecord(account) || !isRecord(account.creds)) {
-      continue;
-    }
-    candidates.push({
-      path: `channels.whatsapp.accounts.${accountId}.creds.json`,
-      value: account.creds.json,
-    });
-  }
-  return candidates;
-}

package/src/security-fix.ts

@@ -1,71 +0,0 @@
-import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
-import type { ChannelDoctorConfigMutation } from "openclaw/plugin-sdk/channel-contract";
-import { readChannelAllowFromStore } from "openclaw/plugin-sdk/channel-pairing";
-import type { OpenClawConfig } from "openclaw/plugin-sdk/config-types";
-
-function applyGroupAllowFromFromStore(params: {
-  cfg: OpenClawConfig;
-  storeAllowFrom: string[];
-  changes: string[];
-}): OpenClawConfig {
-  const next = structuredClone(params.cfg ?? {});
-  const section = next.channels?.whatsapp as Record<string, unknown> | undefined;
-  if (!section || typeof section !== "object" || params.storeAllowFrom.length === 0) {
-    return params.cfg;
-  }
-
-  let changed = false;
-  const maybeApply = (prefix: string, holder: Record<string, unknown>) => {
-    if (holder.groupPolicy !== "allowlist") {
-      return;
-    }
-    const allowFrom = Array.isArray(holder.allowFrom) ? holder.allowFrom : [];
-    const groupAllowFrom = Array.isArray(holder.groupAllowFrom) ? holder.groupAllowFrom : [];
-    if (allowFrom.length > 0 || groupAllowFrom.length > 0) {
-      return;
-    }
-    holder.groupAllowFrom = params.storeAllowFrom;
-    params.changes.push(`${prefix}groupAllowFrom=pairing-store`);
-    changed = true;
-  };
-
-  maybeApply("channels.whatsapp.", section);
-
-  const accounts = section.accounts;
-  if (accounts && typeof accounts === "object") {
-    for (const [accountId, accountValue] of Object.entries(accounts)) {
-      if (!accountValue || typeof accountValue !== "object") {
-        continue;
-      }
-      maybeApply(
-        `channels.whatsapp.accounts.${accountId}.`,
-        accountValue as Record<string, unknown>,
-      );
-    }
-  }
-
-  return changed ? next : params.cfg;
-}
-
-export async function applyWhatsAppSecurityConfigFixes(params: {
-  cfg: OpenClawConfig;
-  env: NodeJS.ProcessEnv;
-}): Promise<ChannelDoctorConfigMutation> {
-  const fromStore = await readChannelAllowFromStore(
-    "whatsapp",
-    params.env,
-    DEFAULT_ACCOUNT_ID,
-  ).catch(() => []);
-  const normalized = Array.from(new Set(fromStore.map((entry) => entry.trim()))).filter(Boolean);
-  if (normalized.length === 0) {
-    return { config: params.cfg, changes: [] };
-  }
-
-  const changes: string[] = [];
-  const config = applyGroupAllowFromFromStore({
-    cfg: params.cfg,
-    storeAllowFrom: normalized,
-    changes,
-  });
-  return { config, changes };
-}