@openclaw/whatsapp 2026.5.20-beta.1 → 2026.5.20

package/dist/{access-control-CBNRBEa4.js → access-control-p_vcYDW7.js}

@@ -1,4 +1,4 @@
-import { a as resolveWhatsAppAccount } from "./accounts-DskwwYAM.js";
+import { a as resolveWhatsAppAccount } from "./accounts-BPYgj8Fv.js";
 import { l as isSelfChatMode, n as normalizeE164 } from "./text-runtime-Dk37KYHj.js";
 import { a as getSelfIdentity, o as getSenderIdentity } from "./identity-xoLLdqEv.js";
 import { t as resolveWhatsAppRuntimeGroupPolicy } from "./runtime-group-policy-DeSRFXEV.js";

package/dist/{accounts-DskwwYAM.js → accounts-BPYgj8Fv.js}

@@ -1,6 +1,6 @@
 import { t as resolveMergedWhatsAppAccountConfig } from "./account-config-Bxl16soz.js";
 import { n as listConfiguredAccountIds, r as resolveDefaultWhatsAppAccountId, t as listAccountIds } from "./account-ids-CB5SOWjc.js";
-import { t as hasWebCredsSync } from "./creds-files-D9VwL4Az.js";
+import { n as hasWebCredsRegularFileSync, r as hasWebCredsSync } from "./creds-files-B1kSWtBg.js";
 import fs from "node:fs";
 import path from "node:path";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId, resolveUserPath } from "openclaw/plugin-sdk/account-core";
@@ -36,11 +36,7 @@ function resolveLegacyAuthDir() {
 	return resolveOAuthDir();
 }
 function legacyAuthExists(authDir) {
-	try {
-		return fs.existsSync(path.join(authDir, "creds.json"));
-	} catch {
-		return false;
-	}
+	return hasWebCredsRegularFileSync(authDir);
 }
 function resolveWhatsAppAuthDir(params) {
 	const accountId = params.accountId.trim() || DEFAULT_ACCOUNT_ID;

package/dist/{action-runtime-Up8OrLd_.js → action-runtime-D4UqEXqf.js}

@@ -1,7 +1,7 @@
-import { a as resolveWhatsAppAccount } from "./accounts-DskwwYAM.js";
+import { a as resolveWhatsAppAccount } from "./accounts-BPYgj8Fv.js";
 import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-CV-iBmSG.js";
 import { t as resolveWhatsAppReactionLevel } from "./reaction-level-BqMOEBeq.js";
-import { r as sendReactionWhatsApp } from "./send-CiXxYtQ_.js";
+import { r as sendReactionWhatsApp } from "./send-E_kMiuZP.js";
 import { ToolAuthorizationError, createActionGate, jsonResult, readReactionParams, readStringParam } from "openclaw/plugin-sdk/channel-actions";
 //#region extensions/whatsapp/src/action-runtime-target-auth.ts
 function resolveAuthorizedWhatsAppOutboundTarget(params) {

package/dist/action-runtime-api.js

@@ -1,2 +1,2 @@
-import { t as handleWhatsAppAction } from "./action-runtime-Up8OrLd_.js";
+import { t as handleWhatsAppAction } from "./action-runtime-D4UqEXqf.js";
 export { handleWhatsAppAction };

package/dist/action-runtime.runtime.js

@@ -1,2 +1,2 @@
-import { t as handleWhatsAppAction } from "./action-runtime-Up8OrLd_.js";
+import { t as handleWhatsAppAction } from "./action-runtime-D4UqEXqf.js";
 export { handleWhatsAppAction };

package/dist/{agent-tools-login-EtLHKziO.js → agent-tools-login-BDzvb3ee.js}

@@ -10,7 +10,6 @@ function createWhatsAppLoginTool() {
 	return {
 		label: "WhatsApp Login",
 		name: "whatsapp_login",
-		ownerOnly: true,
 		description: "Generate a WhatsApp QR code for linking, or wait for the scan to complete.",
 		parameters: Type.Object({
 			action: Type.Unsafe({

package/dist/api.js

@@ -1,21 +1,21 @@
 import { r as resolveDefaultWhatsAppAccountId, t as listAccountIds } from "./account-ids-CB5SOWjc.js";
-import { a as resolveWhatsAppAccount, i as listWhatsAppAuthDirs, n as hasAnyWhatsAppAuth, o as resolveWhatsAppAuthDir, r as listEnabledWhatsAppAccounts, s as resolveWhatsAppMediaMaxBytes, t as DEFAULT_WHATSAPP_MEDIA_MAX_MB } from "./accounts-DskwwYAM.js";
+import { a as resolveWhatsAppAccount, i as listWhatsAppAuthDirs, n as hasAnyWhatsAppAuth, o as resolveWhatsAppAuthDir, r as listEnabledWhatsAppAccounts, s as resolveWhatsAppMediaMaxBytes, t as DEFAULT_WHATSAPP_MEDIA_MAX_MB } from "./accounts-BPYgj8Fv.js";
 import { a as normalizeWhatsAppAllowFromEntries, c as normalizeWhatsAppTarget, i as looksLikeWhatsAppTargetId, r as isWhatsAppUserTarget, s as normalizeWhatsAppMessagingTarget, t as isWhatsAppGroupJid } from "./normalize-target-bVWjgftN.js";
 import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-CV-iBmSG.js";
 import "./reaction-level-BqMOEBeq.js";
 import { c as assertWebChannel, d as markdownToWhatsApp, f as resolveJidToE164, l as isSelfChatMode, m as toWhatsappJidWithLid, n as normalizeE164, p as toWhatsappJid, r as resolveUserPath, u as jidToE164 } from "./text-runtime-Dk37KYHj.js";
-import "./send-CiXxYtQ_.js";
-import { t as whatsappPlugin } from "./channel-Ij-BWm7q.js";
-import { n as WHATSAPP_LEGACY_OUTBOUND_SEND_DEP_KEYS } from "./outbound-base-BCEEnbqz.js";
+import "./send-E_kMiuZP.js";
+import { t as whatsappPlugin } from "./channel-BVMD1oZL.js";
+import { n as WHATSAPP_LEGACY_OUTBOUND_SEND_DEP_KEYS } from "./outbound-base-E84SMkd9.js";
 import { t as whatsappCommandPolicy } from "./command-policy-BIOSHySD.js";
-import { a as resolveWhatsAppGroupRequireMention, o as resolveWhatsAppGroupToolPolicy, s as resolveWhatsAppGroupIntroHint } from "./setup-core-m8ba61Dp.js";
+import { a as resolveWhatsAppGroupRequireMention, o as resolveWhatsAppGroupToolPolicy, s as resolveWhatsAppGroupIntroHint } from "./setup-core-Dm1hsI3r.js";
 import "./config-schema-CsNDlDpL.js";
-import { t as whatsappSetupPlugin } from "./channel.setup-CBHtRTDw.js";
+import { t as whatsappSetupPlugin } from "./channel.setup-BDH3Mk5M.js";
 import { t as DEFAULT_WEB_MEDIA_BYTES } from "./constants-HU41RHGI.js";
 import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-CfLFAK54.js";
-import { n as testing } from "./access-control-CBNRBEa4.js";
-import { p as extractText, t as createWebSendApi } from "./send-api-CcNZTwSs.js";
-import { r as waitForWaConnection, t as createWaSocket } from "./session-Bn5i1Fqp.js";
+import { n as testing } from "./access-control-p_vcYDW7.js";
+import { p as extractText, t as createWebSendApi } from "./send-api-CXPUXbUL.js";
+import { r as waitForWaConnection, t as createWaSocket } from "./session-CPsgRMMa.js";
 import "openclaw/plugin-sdk/channel-actions";
 import "openclaw/plugin-sdk/account-resolution";
 import "openclaw/plugin-sdk/core";

package/dist/auth-presence.js

@@ -1,4 +1,4 @@
-import { t as hasWebCredsSync } from "./creds-files-D9VwL4Az.js";
+import { r as hasWebCredsSync } from "./creds-files-B1kSWtBg.js";
 import fs from "node:fs";
 import path from "node:path";
 import { resolveOAuthDir } from "openclaw/plugin-sdk/state-paths";

package/dist/{auth-store-C-5icsdY.js → auth-store-GTQvJznL.js}

@@ -1,14 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
-import { n as resolveWebCredsBackupPath, r as resolveWebCredsPath } from "./creds-files-D9VwL4Az.js";
+import { a as readWebCredsJsonRawSync, c as statWebCredsFileSync, i as readWebCredsJsonRaw, o as resolveWebCredsBackupPath, s as resolveWebCredsPath, t as assertWebCredsPathRegularFileOrMissing } from "./creds-files-B1kSWtBg.js";
 import { r as resolveUserPath } from "./text-runtime-Dk37KYHj.js";
 import { c as resolveComparableIdentity } from "./identity-xoLLdqEv.js";
-import fs from "node:fs";
 import path from "node:path";
 import { resolveOAuthDir as resolveOAuthDir$1 } from "openclaw/plugin-sdk/state-paths";
+import { replaceFileAtomic } from "openclaw/plugin-sdk/security-runtime";
 import { formatCliCommand } from "openclaw/plugin-sdk/cli-runtime";
 import { defaultRuntime, getChildLogger, info, success } from "openclaw/plugin-sdk/runtime-env";
-import { replaceFileAtomic } from "openclaw/plugin-sdk/security-runtime";
-import fs$1 from "node:fs/promises";
+import fs from "node:fs/promises";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/routing";
 //#region extensions/whatsapp/src/creds-persistence.ts
 const CREDS_FILE_MODE = 384;
@@ -18,15 +17,26 @@ async function stringifyCreds(creds) {
 	const { BufferJSON } = await import("./session.runtime-C6uBkEaI.js").then((n) => n.a);
 	return JSON.stringify(creds, BufferJSON.replacer);
 }
-async function writeCredsJsonAtomically(authDir, creds) {
+async function writeWebCredsRawAtomically(params) {
+	await assertWebCredsPathRegularFileOrMissing(params.filePath);
 	await replaceFileAtomic({
-		filePath: resolveWebCredsPath(authDir),
-		content: await stringifyCreds(creds),
+		filePath: params.filePath,
+		content: params.content,
 		dirMode: 448,
 		mode: CREDS_FILE_MODE,
-		tempPrefix: ".creds",
+		tempPrefix: params.tempPrefix,
 		syncTempFile: true,
-		syncParentDir: true
+		syncParentDir: true,
+		beforeRename: async ({ filePath }) => {
+			await assertWebCredsPathRegularFileOrMissing(filePath);
+		}
+	});
+}
+async function writeCredsJsonAtomically(authDir, creds) {
+	await writeWebCredsRawAtomically({
+		filePath: resolveWebCredsPath(authDir),
+		content: await stringifyCreds(creds),
+		tempPrefix: ".creds"
 	});
 }
 function enqueueCredsSave(authDir, saveCreds, onError) {
@@ -94,14 +104,7 @@ function resolveDefaultWebAuthDir() {
 }
 const WA_WEB_AUTH_DIR = resolveDefaultWebAuthDir();
 function readCredsJsonRaw(filePath) {
-	try {
-		if (!fs.existsSync(filePath)) return null;
-		const stats = fs.statSync(filePath);
-		if (!stats.isFile() || stats.size <= 1) return null;
-		return fs.readFileSync(filePath, "utf-8");
-	} catch {
-		return null;
-	}
+	return readWebCredsJsonRawSync(filePath);
 }
 async function waitForWebAuthBarrier(authDir, context) {
 	const result = await waitForCredsSaveQueueWithTimeout(authDir);
@@ -116,6 +119,11 @@ async function restoreCredsFromBackupIfNeeded(authDir) {
 	try {
 		const credsPath = resolveWebCredsPath(authDir);
 		const backupPath = resolveWebCredsBackupPath(authDir);
+		try {
+			await assertWebCredsPathRegularFileOrMissing(credsPath);
+		} catch {
+			return false;
+		}
 		const raw = readCredsJsonRaw(credsPath);
 		if (raw) {
 			JSON.parse(raw);
@@ -123,13 +131,10 @@ async function restoreCredsFromBackupIfNeeded(authDir) {
 		}
 		const backupRaw = readCredsJsonRaw(backupPath);
 		if (!backupRaw) return false;
-		if (!(await fs$1.lstat(backupPath).catch(() => null))?.isFile()) return false;
 		JSON.parse(backupRaw);
-		await replaceFileAtomic({
+		await writeWebCredsRawAtomically({
 			filePath: credsPath,
 			content: backupRaw,
-			dirMode: 448,
-			mode: 384,
 			tempPrefix: ".creds.restore"
 		});
 		logger.warn({ credsPath }, "restored corrupted WhatsApp creds.json from backup");
@@ -138,17 +143,9 @@ async function restoreCredsFromBackupIfNeeded(authDir) {
 	return false;
 }
 async function webAuthExists(authDir = resolveDefaultWebAuthDir()) {
-	const resolvedAuthDir = resolveUserPath(authDir);
-	const credsPath = resolveWebCredsPath(resolvedAuthDir);
-	try {
-		await fs$1.access(resolvedAuthDir);
-	} catch {
-		return false;
-	}
+	const raw = await readWebCredsJsonRaw(resolveWebCredsPath(resolveUserPath(authDir)));
+	if (!raw) return false;
 	try {
-		const stats = await fs$1.stat(credsPath);
-		if (!stats.isFile() || stats.size <= 1) return false;
-		const raw = await fs$1.readFile(credsPath, "utf-8");
 		JSON.parse(raw);
 		return true;
 	} catch {
@@ -222,25 +219,25 @@ function isBaileysAuthFileName(name) {
 	return /^(app-state-sync|session|sender-key|pre-key)-/.test(name);
 }
 async function clearBaileysAuthFiles(authDir) {
-	const rootStats = await fs$1.lstat(authDir).catch(() => null);
+	const rootStats = await fs.lstat(authDir).catch(() => null);
 	if (!rootStats?.isDirectory() || rootStats.isSymbolicLink()) return;
-	const entries = await fs$1.readdir(authDir, { withFileTypes: true });
+	const entries = await fs.readdir(authDir, { withFileTypes: true });
 	await Promise.all(entries.map(async (entry) => {
 		if (!entry.isFile()) return;
 		if (!isBaileysAuthFileName(entry.name)) return;
-		await fs$1.rm(path.join(authDir, entry.name), { force: true });
+		await fs.rm(path.join(authDir, entry.name), { force: true });
 	}));
 }
 async function shouldClearOnLogout(authDir, isLegacyAuthDir) {
 	try {
-		const stats = await fs$1.lstat(authDir);
+		const stats = await fs.lstat(authDir);
 		if (!stats.isDirectory() || stats.isSymbolicLink()) return false;
-		if (isLegacyAuthDir) return (await fs$1.readdir(authDir, { withFileTypes: true })).some((entry) => {
+		if (isLegacyAuthDir) return (await fs.readdir(authDir, { withFileTypes: true })).some((entry) => {
 			if (!entry.isFile()) return false;
 			return isBaileysAuthFileName(entry.name);
 		});
-		if ((await fs$1.lstat(resolveWebCredsPath(authDir)).catch(() => null))?.isFile()) return true;
-		return (await fs$1.lstat(resolveWebCredsBackupPath(authDir)).catch(() => null))?.isFile() === true;
+		if ((await fs.lstat(resolveWebCredsPath(authDir)).catch(() => null))?.isFile()) return true;
+		return (await fs.lstat(resolveWebCredsBackupPath(authDir)).catch(() => null))?.isFile() === true;
 	} catch (error) {
 		const codeValue = error && typeof error === "object" && "code" in error ? error.code : void 0;
 		return (typeof codeValue === "string" ? codeValue : "") !== "ENOENT";
@@ -255,7 +252,7 @@ async function pathHasSymlinkComponent(baseDir, targetPath) {
 	let currentPath = baseDir;
 	for (const segment of relativePath.split(path.sep)) {
 		currentPath = path.join(currentPath, segment);
-		const stats = await fs$1.lstat(currentPath).catch(() => null);
+		const stats = await fs.lstat(currentPath).catch(() => null);
 		if (!stats || stats.isSymbolicLink()) return true;
 	}
 	return false;
@@ -264,14 +261,14 @@ async function isLegacyWebAuthDir(authDir) {
 	const legacyAuthDir = path.resolve(resolveOAuthDir$1());
 	const resolvedAuthDir = path.resolve(authDir);
 	if (resolvedAuthDir !== legacyAuthDir) return false;
-	const stats = await fs$1.lstat(resolvedAuthDir).catch(() => null);
+	const stats = await fs.lstat(resolvedAuthDir).catch(() => null);
 	return stats?.isDirectory() === true && !stats.isSymbolicLink();
 }
 async function classifyWebAuthDirOwnership(authDir) {
 	const whatsappAuthBase = path.resolve(resolveOAuthDir$1(), "whatsapp");
 	const resolvedAuthDir = path.resolve(authDir);
 	if (!isPathInsideDirectory(whatsappAuthBase, resolvedAuthDir)) return { kind: "external" };
-	const [baseRealPath, authDirRealPath] = await Promise.all([fs$1.realpath(whatsappAuthBase).catch(() => null), fs$1.realpath(resolvedAuthDir).catch(() => null)]);
+	const [baseRealPath, authDirRealPath] = await Promise.all([fs.realpath(whatsappAuthBase).catch(() => null), fs.realpath(resolvedAuthDir).catch(() => null)]);
 	if (!baseRealPath || !authDirRealPath) return { kind: "unsafe-owned" };
 	if (!isPathInsideDirectory(baseRealPath, authDirRealPath)) return { kind: "unsafe-owned" };
 	if (await pathHasSymlinkComponent(whatsappAuthBase, resolvedAuthDir)) return { kind: "unsafe-owned" };
@@ -296,7 +293,7 @@ async function logoutWeb(params) {
 		await clearBaileysAuthFiles(resolvedAuthDir);
 	} else {
 		const ownership = await classifyWebAuthDirOwnership(resolvedAuthDir);
-		if (ownership.kind === "owned") await fs$1.rm(ownership.authDir, {
+		if (ownership.kind === "owned") await fs.rm(ownership.authDir, {
 			recursive: true,
 			force: true
 		});
@@ -313,9 +310,8 @@ async function logoutWeb(params) {
 }
 function readWebSelfId(authDir = resolveDefaultWebAuthDir()) {
 	try {
-		const credsPath = resolveWebCredsPath(resolveUserPath(authDir));
-		if (!fs.existsSync(credsPath)) return emptyWebSelfId();
-		const raw = fs.readFileSync(credsPath, "utf-8");
+		const raw = readCredsJsonRaw(resolveWebCredsPath(resolveUserPath(authDir)));
+		if (!raw) return emptyWebSelfId();
 		const parsed = JSON.parse(raw);
 		const identity = resolveComparableIdentity({
 			jid: parsed?.me?.id ?? null,
@@ -332,19 +328,18 @@ function readWebSelfId(authDir = resolveDefaultWebAuthDir()) {
 }
 async function readWebSelfIdentity(authDir = resolveDefaultWebAuthDir(), fallback) {
 	const resolvedAuthDir = resolveUserPath(authDir);
-	try {
-		const raw = await fs$1.readFile(resolveWebCredsPath(resolvedAuthDir), "utf-8");
+	const raw = await readWebCredsJsonRaw(resolveWebCredsPath(resolvedAuthDir));
+	if (raw) try {
 		const parsed = JSON.parse(raw);
 		return resolveComparableIdentity({
 			jid: parsed?.me?.id ?? null,
 			lid: parsed?.me?.lid ?? null
 		}, resolvedAuthDir);
-	} catch {
-		return resolveComparableIdentity({
-			jid: fallback?.id ?? null,
-			lid: fallback?.lid ?? null
-		}, resolvedAuthDir);
-	}
+	} catch {}
+	return resolveComparableIdentity({
+		jid: fallback?.id ?? null,
+		lid: fallback?.lid ?? null
+	}, resolvedAuthDir);
 }
 async function readWebSelfIdentityForDecision(authDir = resolveDefaultWebAuthDir(), fallback) {
 	const resolvedAuthDir = resolveUserPath(authDir);
@@ -359,12 +354,8 @@ async function readWebSelfIdentityForDecision(authDir = resolveDefaultWebAuthDir
 * Helpful for heartbeats/observability to spot stale credentials.
 */
 function getWebAuthAgeMs(authDir = resolveDefaultWebAuthDir()) {
-	try {
-		const stats = fs.statSync(resolveWebCredsPath(resolveUserPath(authDir)));
-		return Date.now() - stats.mtimeMs;
-	} catch {
-		return null;
-	}
+	const stats = statWebCredsFileSync(resolveWebCredsPath(resolveUserPath(authDir)));
+	return stats ? Math.max(0, Date.now() - stats.mtimeMs) : null;
 }
 function logWebSelfId(authDir = resolveDefaultWebAuthDir(), runtime = defaultRuntime, includeChannelPrefix = false) {
 	const { e164, jid, lid } = readWebSelfId(authDir);
@@ -381,4 +372,4 @@ async function pickWebChannel(pref, authDir = resolveDefaultWebAuthDir()) {
 	return choice;
 }
 //#endregion
-export { waitForCredsSaveQueue as C, enqueueCredsSave as S, writeCredsJsonAtomically as T, readWebSelfIdentity as _, formatWhatsAppWebAuthStatusState as a, restoreCredsFromBackupIfNeeded as b, logoutWeb as c, readWebAuthExistsBestEffort as d, readWebAuthExistsForDecision as f, readWebSelfId as g, readWebAuthState as h, auth_store_exports as i, pickWebChannel as l, readWebAuthSnapshotBestEffort as m, WHATSAPP_AUTH_UNSTABLE_CODE as n, getWebAuthAgeMs as o, readWebAuthSnapshot as p, WhatsAppAuthUnstableError as r, logWebSelfId as s, WA_WEB_AUTH_DIR as t, readCredsJsonRaw as u, readWebSelfIdentityForDecision as v, waitForCredsSaveQueueWithTimeout as w, webAuthExists as x, resolveDefaultWebAuthDir as y };
+export { waitForCredsSaveQueue as C, writeWebCredsRawAtomically as E, enqueueCredsSave as S, writeCredsJsonAtomically as T, readWebSelfIdentity as _, formatWhatsAppWebAuthStatusState as a, restoreCredsFromBackupIfNeeded as b, logoutWeb as c, readWebAuthExistsBestEffort as d, readWebAuthExistsForDecision as f, readWebSelfId as g, readWebAuthState as h, auth_store_exports as i, pickWebChannel as l, readWebAuthSnapshotBestEffort as m, WHATSAPP_AUTH_UNSTABLE_CODE as n, getWebAuthAgeMs as o, readWebAuthSnapshot as p, WhatsAppAuthUnstableError as r, logWebSelfId as s, WA_WEB_AUTH_DIR as t, readCredsJsonRaw as u, readWebSelfIdentityForDecision as v, waitForCredsSaveQueueWithTimeout as w, webAuthExists as x, resolveDefaultWebAuthDir as y };

package/dist/{channel-Ij-BWm7q.js → channel-BVMD1oZL.js}

@@ -1,17 +1,17 @@
 import { t as listAccountIds } from "./account-ids-CB5SOWjc.js";
-import { a as resolveWhatsAppAccount } from "./accounts-DskwwYAM.js";
+import { a as resolveWhatsAppAccount } from "./accounts-BPYgj8Fv.js";
 import { c as normalizeWhatsAppTarget, i as looksLikeWhatsAppTargetId, n as isWhatsAppNewsletterJid, o as normalizeWhatsAppAllowFromEntry, s as normalizeWhatsAppMessagingTarget, t as isWhatsAppGroupJid } from "./normalize-target-bVWjgftN.js";
 import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-CV-iBmSG.js";
 import { t as resolveWhatsAppReactionLevel } from "./reaction-level-BqMOEBeq.js";
-import { r as normalizeWhatsAppPayloadTextPreservingIndentation } from "./outbound-media-contract-Dk324Pce.js";
+import { r as normalizeWhatsAppPayloadTextPreservingIndentation } from "./outbound-media-contract-ioTkt8tn.js";
 import "./normalize-Bxwqo-bW.js";
-import { i as sendTypingWhatsApp, n as sendPollWhatsApp, t as sendMessageWhatsApp } from "./send-CiXxYtQ_.js";
-import { t as createWhatsAppLoginTool } from "./agent-tools-login-EtLHKziO.js";
-import { t as createWhatsAppOutboundBase } from "./outbound-base-BCEEnbqz.js";
+import { i as sendTypingWhatsApp, n as sendPollWhatsApp, t as sendMessageWhatsApp } from "./send-E_kMiuZP.js";
+import { t as createWhatsAppLoginTool } from "./agent-tools-login-BDzvb3ee.js";
+import { t as createWhatsAppOutboundBase } from "./outbound-base-E84SMkd9.js";
 import { t as getWhatsAppRuntime } from "./runtime-CboC4QhQ.js";
 import { t as whatsappCommandPolicy } from "./command-policy-BIOSHySD.js";
-import { a as resolveWhatsAppGroupRequireMention, c as resolveWhatsAppMentionStripRegexes, i as whatsappSetupWizardProxy, l as formatWhatsAppConfigAllowFromEntries, n as createWhatsAppPluginBase, o as resolveWhatsAppGroupToolPolicy, r as loadWhatsAppChannelRuntime, s as resolveWhatsAppGroupIntroHint, t as whatsappSetupAdapter } from "./setup-core-m8ba61Dp.js";
-import { f as readWebAuthExistsForDecision, n as WHATSAPP_AUTH_UNSTABLE_CODE } from "./auth-store-C-5icsdY.js";
+import { a as resolveWhatsAppGroupRequireMention, c as resolveWhatsAppMentionStripRegexes, i as whatsappSetupWizardProxy, l as formatWhatsAppConfigAllowFromEntries, n as createWhatsAppPluginBase, o as resolveWhatsAppGroupToolPolicy, r as loadWhatsAppChannelRuntime, s as resolveWhatsAppGroupIntroHint, t as whatsappSetupAdapter } from "./setup-core-Dm1hsI3r.js";
+import { f as readWebAuthExistsForDecision, n as WHATSAPP_AUTH_UNSTABLE_CODE } from "./auth-store-GTQvJznL.js";
 import { t as detectWhatsAppLegacyStateMigrations } from "./state-migrations-D_BmQUR9.js";
 import { createActionGate as createActionGate$1 } from "openclaw/plugin-sdk/channel-actions";
 import { asString, collectIssuesForEnabledAccounts, createAsyncComputedAccountStatusAdapter, createDefaultChannelRuntimeState, isRecord } from "openclaw/plugin-sdk/status-helpers";
@@ -323,7 +323,7 @@ function collectWhatsAppStatusIssues(accounts) {
 //#endregion
 //#region extensions/whatsapp/src/channel.ts
 const loadWhatsAppDirectoryConfig = createLazyRuntimeModule(() => import("./directory-config-CfLFAK54.js").then((n) => n.t));
-const loadWhatsAppChannelReactAction = createLazyRuntimeModule(() => import("./channel-react-action-DEUfqgMx.js"));
+const loadWhatsAppChannelReactAction = createLazyRuntimeModule(() => import("./channel-react-action-CHdR3gbn.js"));
 function parseWhatsAppExplicitTarget(raw) {
 	const normalized = normalizeWhatsAppTarget(raw);
 	if (!normalized) return null;

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as whatsappPlugin } from "./channel-Ij-BWm7q.js";
+import { t as whatsappPlugin } from "./channel-BVMD1oZL.js";
 export { whatsappPlugin };

package/dist/{channel-react-action-DEUfqgMx.js → channel-react-action-CHdR3gbn.js}

@@ -1,8 +1,8 @@
-import { a as resolveWhatsAppAccount, s as resolveWhatsAppMediaMaxBytes } from "./accounts-DskwwYAM.js";
+import { a as resolveWhatsAppAccount, s as resolveWhatsAppMediaMaxBytes } from "./accounts-BPYgj8Fv.js";
 import { c as normalizeWhatsAppTarget, t as isWhatsAppGroupJid } from "./normalize-target-bVWjgftN.js";
-import { r as resolveAuthorizedWhatsAppOutboundTarget, t as handleWhatsAppAction } from "./action-runtime-Up8OrLd_.js";
+import { r as resolveAuthorizedWhatsAppOutboundTarget, t as handleWhatsAppAction } from "./action-runtime-D4UqEXqf.js";
 import "./normalize-Bxwqo-bW.js";
-import { t as sendMessageWhatsApp } from "./send-CiXxYtQ_.js";
+import { t as sendMessageWhatsApp } from "./send-E_kMiuZP.js";
 import { jsonResult, readStringOrNumberParam, readStringParam as readStringParam$1, resolveReactionMessageId } from "openclaw/plugin-sdk/channel-actions";
 //#region extensions/whatsapp/src/channel-react-action.ts
 const WHATSAPP_CHANNEL = "whatsapp";

package/dist/{channel.runtime-CvfJiuex.js → channel.runtime-BBPZSziE.js}

@@ -1,9 +1,9 @@
 import { startWebLoginWithQr as startWebLoginWithQr$1, waitForWebLogin as waitForWebLogin$1 } from "./login-qr-runtime.js";
-import { c as logoutWeb$1, d as readWebAuthExistsBestEffort$1, f as readWebAuthExistsForDecision$1, g as readWebSelfId$1, h as readWebAuthState$1, m as readWebAuthSnapshotBestEffort$1, o as getWebAuthAgeMs$1, p as readWebAuthSnapshot$1, s as logWebSelfId$1, x as webAuthExists$1 } from "./auth-store-C-5icsdY.js";
+import { c as logoutWeb$1, d as readWebAuthExistsBestEffort$1, f as readWebAuthExistsForDecision$1, g as readWebSelfId$1, h as readWebAuthState$1, m as readWebAuthSnapshotBestEffort$1, o as getWebAuthAgeMs$1, p as readWebAuthSnapshot$1, s as logWebSelfId$1, x as webAuthExists$1 } from "./auth-store-GTQvJznL.js";
 import { t as getActiveWebListener$1 } from "./active-listener-B4SDebQ6.js";
-import { t as monitorWebChannel$1 } from "./monitor-DYvWelW5.js";
-import { t as loginWeb$1 } from "./login-CGOtBPVS.js";
-import { whatsappSetupWizard as whatsappSetupWizard$1 } from "./setup-surface-D4sy0_LW.js";
+import { t as monitorWebChannel$1 } from "./monitor-Dw2i5QSQ.js";
+import { t as loginWeb$1 } from "./login-nJwaNuC-.js";
+import { whatsappSetupWizard as whatsappSetupWizard$1 } from "./setup-surface-DqY0LqAY.js";
 //#region extensions/whatsapp/src/channel.runtime.ts
 function getActiveWebListener(...args) {
 	return getActiveWebListener$1(...args);

package/dist/{channel.setup-CBHtRTDw.js → channel.setup-BDH3Mk5M.js}

@@ -1,8 +1,8 @@
-import { a as resolveWhatsAppGroupRequireMention, i as whatsappSetupWizardProxy, n as createWhatsAppPluginBase, o as resolveWhatsAppGroupToolPolicy, s as resolveWhatsAppGroupIntroHint, t as whatsappSetupAdapter } from "./setup-core-m8ba61Dp.js";
+import { a as resolveWhatsAppGroupRequireMention, i as whatsappSetupWizardProxy, n as createWhatsAppPluginBase, o as resolveWhatsAppGroupToolPolicy, s as resolveWhatsAppGroupIntroHint, t as whatsappSetupAdapter } from "./setup-core-Dm1hsI3r.js";
 import { t as detectWhatsAppLegacyStateMigrations } from "./state-migrations-D_BmQUR9.js";
 //#region extensions/whatsapp/src/channel.setup.ts
 async function isWhatsAppAuthConfigured(account) {
-	const { readWebAuthState } = await import("./auth-store-C-5icsdY.js").then((n) => n.i);
+	const { readWebAuthState } = await import("./auth-store-GTQvJznL.js").then((n) => n.i);
 	return await readWebAuthState(account.authDir) === "linked";
 }
 const whatsappSetupPlugin = {

package/dist/{connection-controller-CPWZZXwV.js → connection-controller-9TXWZRhx.js}

@@ -1,7 +1,7 @@
 import { n as registerWhatsAppConnectionController, r as unregisterWhatsAppConnectionController } from "./connection-controller-registry-TSX_udJp.js";
 import { n as getStatusCode, t as formatError } from "./session-errors-BAj9D2La.js";
-import { c as logoutWeb } from "./auth-store-C-5icsdY.js";
-import { r as waitForWaConnection, t as createWaSocket } from "./session-Bn5i1Fqp.js";
+import { c as logoutWeb } from "./auth-store-GTQvJznL.js";
+import { r as waitForWaConnection, t as createWaSocket } from "./session-CPsgRMMa.js";
 import { computeBackoff, info, sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
 import { clamp } from "openclaw/plugin-sdk/text-utility-runtime";
 import { DisconnectReason } from "baileys";

package/dist/contract-api.js

@@ -5,7 +5,7 @@ import { n as unsupportedSecretRefSurfacePatterns, t as collectUnsupportedSecret
 import { r as isLegacyGroupSessionKey$1, t as canonicalizeLegacySessionKey$1 } from "./session-contract-DMTm6Q_L.js";
 import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-CfLFAK54.js";
 import { t as resolveWhatsAppRuntimeGroupPolicy$1 } from "./runtime-group-policy-DeSRFXEV.js";
-import { n as testing } from "./access-control-CBNRBEa4.js";
+import { n as testing } from "./access-control-p_vcYDW7.js";
 //#region extensions/whatsapp/contract-api.ts
 const canonicalizeLegacySessionKey = canonicalizeLegacySessionKey$1;
 const isLegacyGroupSessionKey = isLegacyGroupSessionKey$1;

package/dist/creds-files-B1kSWtBg.js

@@ -0,0 +1,79 @@
+import path from "node:path";
+import { assertNoSymlinkParents, assertNoSymlinkParentsSync, readRegularFile, readRegularFileSync, statRegularFile, statRegularFileSync } from "openclaw/plugin-sdk/security-runtime";
+//#region extensions/whatsapp/src/creds-files.ts
+function resolveWebCredsPath(authDir) {
+	return path.join(authDir, "creds.json");
+}
+function resolveWebCredsBackupPath(authDir) {
+	return path.join(authDir, "creds.json.bak");
+}
+function resolveWebCredsParentCheck(filePath) {
+	const dir = path.resolve(path.dirname(filePath));
+	return {
+		rootDir: path.parse(dir).root,
+		targetPath: dir,
+		allowMissing: true,
+		allowRootChildSymlink: true,
+		requireDirectories: true,
+		messagePrefix: "WhatsApp credential file path"
+	};
+}
+async function assertWebCredsParentPathSafe(filePath) {
+	await assertNoSymlinkParents(resolveWebCredsParentCheck(filePath));
+}
+function assertWebCredsParentPathSafeSync(filePath) {
+	assertNoSymlinkParentsSync(resolveWebCredsParentCheck(filePath));
+}
+async function assertWebCredsPathRegularFileOrMissing(filePath) {
+	try {
+		await assertWebCredsParentPathSafe(filePath);
+		await statRegularFile(filePath);
+	} catch (error) {
+		throw new Error(`WhatsApp credential file path is unsafe; creds.json must be a regular file or missing: ${filePath}`, { cause: error });
+	}
+}
+function readWebCredsJsonRawSync(filePath) {
+	try {
+		assertWebCredsParentPathSafeSync(filePath);
+		const { buffer, stat } = readRegularFileSync({ filePath });
+		return stat.size > 1 ? buffer.toString("utf-8") : null;
+	} catch {
+		return null;
+	}
+}
+async function readWebCredsJsonRaw(filePath) {
+	try {
+		await assertWebCredsParentPathSafe(filePath);
+		const { buffer, stat } = await readRegularFile({ filePath });
+		return stat.size > 1 ? buffer.toString("utf-8") : null;
+	} catch {
+		return null;
+	}
+}
+function statWebCredsFileSync(filePath) {
+	try {
+		assertWebCredsParentPathSafeSync(filePath);
+		const result = statRegularFileSync(filePath);
+		if (result.missing || result.stat.size <= 1) return null;
+		return {
+			mtimeMs: result.stat.mtimeMs,
+			size: result.stat.size
+		};
+	} catch {
+		return null;
+	}
+}
+function hasWebCredsRegularFileSync(authDir) {
+	try {
+		const credsPath = resolveWebCredsPath(authDir);
+		assertWebCredsParentPathSafeSync(credsPath);
+		return !statRegularFileSync(credsPath).missing;
+	} catch {
+		return false;
+	}
+}
+function hasWebCredsSync(authDir) {
+	return statWebCredsFileSync(resolveWebCredsPath(authDir)) !== null;
+}
+//#endregion
+export { readWebCredsJsonRawSync as a, statWebCredsFileSync as c, readWebCredsJsonRaw as i, hasWebCredsRegularFileSync as n, resolveWebCredsBackupPath as o, hasWebCredsSync as r, resolveWebCredsPath as s, assertWebCredsPathRegularFileOrMissing as t };

package/dist/light-runtime-api.js

@@ -1,5 +1,5 @@
 import { n as getStatusCode, t as formatError } from "./session-errors-BAj9D2La.js";
-import { t as createWhatsAppLoginTool } from "./agent-tools-login-EtLHKziO.js";
-import { c as logoutWeb, g as readWebSelfId, l as pickWebChannel, o as getWebAuthAgeMs, s as logWebSelfId, t as WA_WEB_AUTH_DIR, x as webAuthExists } from "./auth-store-C-5icsdY.js";
+import { t as createWhatsAppLoginTool } from "./agent-tools-login-BDzvb3ee.js";
+import { c as logoutWeb, g as readWebSelfId, l as pickWebChannel, o as getWebAuthAgeMs, s as logWebSelfId, t as WA_WEB_AUTH_DIR, x as webAuthExists } from "./auth-store-GTQvJznL.js";
 import { t as getActiveWebListener } from "./active-listener-B4SDebQ6.js";
 export { WA_WEB_AUTH_DIR, createWhatsAppLoginTool, formatError, getActiveWebListener, getStatusCode, getWebAuthAgeMs, logWebSelfId, logoutWeb, pickWebChannel, readWebSelfId, webAuthExists };

package/dist/{login-CGOtBPVS.js → login-nJwaNuC-.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
-import { a as resolveWhatsAppAccount } from "./accounts-DskwwYAM.js";
-import { b as restoreCredsFromBackupIfNeeded } from "./auth-store-C-5icsdY.js";
-import { a as renderQrTerminal, i as resolveWhatsAppSocketTiming, t as createWaSocket } from "./session-Bn5i1Fqp.js";
-import { a as closeWaSocketSoon, o as waitForWhatsAppLoginResult } from "./connection-controller-CPWZZXwV.js";
+import { a as resolveWhatsAppAccount } from "./accounts-BPYgj8Fv.js";
+import { b as restoreCredsFromBackupIfNeeded } from "./auth-store-GTQvJznL.js";
+import { a as renderQrTerminal, i as resolveWhatsAppSocketTiming, t as createWaSocket } from "./session-CPsgRMMa.js";
+import { a as closeWaSocketSoon, o as waitForWhatsAppLoginResult } from "./connection-controller-9TXWZRhx.js";
 import { formatCliCommand } from "openclaw/plugin-sdk/cli-runtime";
 import { logInfo } from "openclaw/plugin-sdk/logging-core";
 import { danger, defaultRuntime, success } from "openclaw/plugin-sdk/runtime-env";

package/dist/{login-qr-BYNpc3IS.js → login-qr-l4UaR8Dj.js}

@@ -1,7 +1,7 @@
-import { a as resolveWhatsAppAccount } from "./accounts-DskwwYAM.js";
-import { f as readWebAuthExistsForDecision, g as readWebSelfId, n as WHATSAPP_AUTH_UNSTABLE_CODE } from "./auth-store-C-5icsdY.js";
-import { i as resolveWhatsAppSocketTiming, t as createWaSocket } from "./session-Bn5i1Fqp.js";
-import { i as closeWaSocket, o as waitForWhatsAppLoginResult, t as WHATSAPP_LOGGED_OUT_QR_MESSAGE } from "./connection-controller-CPWZZXwV.js";
+import { a as resolveWhatsAppAccount } from "./accounts-BPYgj8Fv.js";
+import { f as readWebAuthExistsForDecision, g as readWebSelfId, n as WHATSAPP_AUTH_UNSTABLE_CODE } from "./auth-store-GTQvJznL.js";
+import { i as resolveWhatsAppSocketTiming, t as createWaSocket } from "./session-CPsgRMMa.js";
+import { i as closeWaSocket, o as waitForWhatsAppLoginResult, t as WHATSAPP_LOGGED_OUT_QR_MESSAGE } from "./connection-controller-9TXWZRhx.js";
 import { logInfo } from "openclaw/plugin-sdk/logging-core";
 import { danger, defaultRuntime, info, success } from "openclaw/plugin-sdk/runtime-env";
 import { renderQrPngDataUrl } from "openclaw/plugin-sdk/media-runtime";

package/dist/login-qr-runtime.js

@@ -1,7 +1,7 @@
 //#region extensions/whatsapp/login-qr-runtime.ts
 let loginQrModulePromise = null;
 function loadLoginQrModule() {
-	loginQrModulePromise ??= import("./login-qr-BYNpc3IS.js");
+	loginQrModulePromise ??= import("./login-qr-l4UaR8Dj.js");
 	return loginQrModulePromise;
 }
 async function startWebLoginWithQr(...args) {

package/dist/{monitor-DYvWelW5.js → monitor-Dw2i5QSQ.js}

@@ -1,26 +1,26 @@
-import { a as resolveWhatsAppAccount, s as resolveWhatsAppMediaMaxBytes } from "./accounts-DskwwYAM.js";
+import { a as resolveWhatsAppAccount, s as resolveWhatsAppMediaMaxBytes } from "./accounts-BPYgj8Fv.js";
 import { t as isWhatsAppGroupJid } from "./normalize-target-bVWjgftN.js";
 import { t as resolveWhatsAppReactionLevel } from "./reaction-level-BqMOEBeq.js";
-import { i as prepareWhatsAppOutboundMedia, o as sendWhatsAppOutboundWithRetry, r as normalizeWhatsAppPayloadTextPreservingIndentation, t as normalizeWhatsAppOutboundPayload } from "./outbound-media-contract-Dk324Pce.js";
+import { i as prepareWhatsAppOutboundMedia, o as sendWhatsAppOutboundWithRetry, r as normalizeWhatsAppPayloadTextPreservingIndentation, t as normalizeWhatsAppOutboundPayload } from "./outbound-media-contract-ioTkt8tn.js";
 import { n as getStatusCode, t as formatError } from "./session-errors-BAj9D2La.js";
 import { d as markdownToWhatsApp, f as resolveJidToE164, l as isSelfChatMode, n as normalizeE164, t as convertMarkdownTables$1, u as jidToE164 } from "./text-runtime-Dk37KYHj.js";
-import { r as sendReactionWhatsApp } from "./send-CiXxYtQ_.js";
+import { r as sendReactionWhatsApp } from "./send-E_kMiuZP.js";
 import { n as cacheInboundMessageMeta, r as lookupInboundMessageMeta, t as buildQuotedMessageOptions } from "./quoted-message-CveINB35.js";
-import { c as logoutWeb, g as readWebSelfId, o as getWebAuthAgeMs, r as WhatsAppAuthUnstableError, v as readWebSelfIdentityForDecision } from "./auth-store-C-5icsdY.js";
+import { c as logoutWeb, g as readWebSelfId, o as getWebAuthAgeMs, r as WhatsAppAuthUnstableError, v as readWebSelfIdentityForDecision } from "./auth-store-GTQvJznL.js";
 import { a as getSelfIdentity, c as resolveComparableIdentity, i as getReplyContext, n as getMentionIdentities, o as getSenderIdentity, r as getPrimaryIdentityId, s as identitiesOverlap, t as getComparableIdentityValues } from "./identity-xoLLdqEv.js";
-import { i as resolveWhatsAppInboundPolicy, r as resolveWhatsAppCommandAuthorized, t as checkInboundAccessControl } from "./access-control-CBNRBEa4.js";
-import { a as mayContainWhatsAppOutboundMention, c as extractContactContext, d as extractMediaPlaceholder, f as extractMentionedJids, i as addWhatsAppOutboundMentionsToContent, l as extractContextInfo, m as hasInboundUserContent, n as listWhatsAppSendResultMessageIds, o as resolveWhatsAppOutboundMentions, p as extractText, r as normalizeWhatsAppSendResult, s as describeReplyContext, t as createWebSendApi, u as extractLocationData } from "./send-api-CcNZTwSs.js";
-import { i as resolveWhatsAppSocketTiming, r as waitForWaConnection, t as createWaSocket } from "./session-Bn5i1Fqp.js";
-import { c as computeBackoff, d as resolveReconnectPolicy, f as sleepWithAbort, l as newConnectionId, n as WHATSAPP_WATCHDOG_TIMEOUT_ERROR, r as WhatsAppConnectionController, s as DEFAULT_RECONNECT_POLICY, u as resolveHeartbeatSeconds } from "./connection-controller-CPWZZXwV.js";
+import { i as resolveWhatsAppInboundPolicy, r as resolveWhatsAppCommandAuthorized, t as checkInboundAccessControl } from "./access-control-p_vcYDW7.js";
+import { a as mayContainWhatsAppOutboundMention, c as extractContactContext, d as extractMediaPlaceholder, f as extractMentionedJids, i as addWhatsAppOutboundMentionsToContent, l as extractContextInfo, m as hasInboundUserContent, n as listWhatsAppSendResultMessageIds, o as resolveWhatsAppOutboundMentions, p as extractText, r as normalizeWhatsAppSendResult, s as describeReplyContext, t as createWebSendApi, u as extractLocationData } from "./send-api-CXPUXbUL.js";
+import { i as resolveWhatsAppSocketTiming, r as waitForWaConnection, t as createWaSocket } from "./session-CPsgRMMa.js";
+import { c as computeBackoff, d as resolveReconnectPolicy, f as sleepWithAbort, l as newConnectionId, n as WHATSAPP_WATCHDOG_TIMEOUT_ERROR, r as WhatsAppConnectionController, s as DEFAULT_RECONNECT_POLICY, u as resolveHeartbeatSeconds } from "./connection-controller-9TXWZRhx.js";
 import { resolveAccountEntry } from "openclaw/plugin-sdk/account-core";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { evaluateSupplementalContextVisibility, filterSupplementalContextItems, resolvePinnedMainDmOwnerFromAllowlist } from "openclaw/plugin-sdk/security-runtime";
 import { DEFAULT_TIMING, createAckReactionHandle, createStatusReactionController, logAckFailure, removeAckReactionHandleAfterReply, shouldAckReactionForWhatsApp } from "openclaw/plugin-sdk/channel-feedback";
 import { formatCliCommand } from "openclaw/plugin-sdk/cli-runtime";
 import { getChildLogger } from "openclaw/plugin-sdk/logging-core";
 import { resolveMarkdownTableMode as resolveMarkdownTableMode$1 } from "openclaw/plugin-sdk/markdown-table-runtime";
 import { createSubsystemLogger, defaultRuntime, formatDurationPrecise, getChildLogger as getChildLogger$1, logVerbose, logVerbose as logVerbose$1, registerUnhandledRejectionHandler, shouldLogVerbose, shouldLogVerbose as shouldLogVerbose$1, warn } from "openclaw/plugin-sdk/runtime-env";
 import { getAgentScopedMediaLocalRoots } from "openclaw/plugin-sdk/media-runtime";
-import { evaluateSupplementalContextVisibility, filterSupplementalContextItems, resolvePinnedMainDmOwnerFromAllowlist } from "openclaw/plugin-sdk/security-runtime";
 import { LocalMediaAccessError, getDefaultLocalRoots, loadWebMedia as loadWebMedia$1, loadWebMediaRaw, optimizeImageToJpeg, optimizeImageToPng } from "openclaw/plugin-sdk/web-media";
 import { createChannelMessageReplyPipeline, createMessageReceiptFromOutboundResults, deliverInboundReplyWithMessageSendContext, resolveChannelMessageSourceReplyDeliveryMode } from "openclaw/plugin-sdk/channel-message";
 import { chunkMarkdownTextWithMode } from "openclaw/plugin-sdk/reply-chunking";
@@ -3074,10 +3074,7 @@ async function monitorWebChannel(verbose, listenerFactory = attachWebInboxToSock
 				channel: "whatsapp",
 				accountId: account.accountId
 			});
-			enqueueSystemEvent(`WhatsApp gateway connected${selfE164 ? ` as ${selfE164}` : ""}.`, {
-				sessionKey: connectRoute.sessionKey,
-				trusted: true
-			});
+			enqueueSystemEvent(`WhatsApp gateway connected${selfE164 ? ` as ${selfE164}` : ""}.`, { sessionKey: connectRoute.sessionKey });
 			const normalizedAccountId = normalizeReconnectAccountId(account.accountId);
 			drainPendingDeliveries({
 				drainKey: `whatsapp:${normalizedAccountId}`,
@@ -3145,10 +3142,7 @@ async function monitorWebChannel(verbose, listenerFactory = attachWebInboxToSock
 				reconnectAttempts: decision.reconnectAttempts,
 				error: decision.normalized.errorText
 			}, "web reconnect: connection closed");
-			enqueueSystemEvent(`WhatsApp gateway disconnected (status ${decision.normalized.statusLabel})`, {
-				sessionKey: connectRoute.sessionKey,
-				trusted: true
-			});
+			enqueueSystemEvent(`WhatsApp gateway disconnected (status ${decision.normalized.statusLabel})`, { sessionKey: connectRoute.sessionKey });
 			if (decision.action === "stop") {
 				await controller.closeCurrentConnection();
 				statusController.noteClose({

package/dist/{outbound-adapter-AQXm0jeQ.js → outbound-adapter-ltiZkW9L.js}

@@ -1,12 +1,12 @@
 import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-CV-iBmSG.js";
-import { n as normalizeWhatsAppPayloadText } from "./outbound-media-contract-Dk324Pce.js";
-import { t as createWhatsAppOutboundBase } from "./outbound-base-BCEEnbqz.js";
+import { n as normalizeWhatsAppPayloadText } from "./outbound-media-contract-ioTkt8tn.js";
+import { t as createWhatsAppOutboundBase } from "./outbound-base-E84SMkd9.js";
 import { shouldLogVerbose } from "openclaw/plugin-sdk/runtime-env";
 import { chunkText } from "openclaw/plugin-sdk/reply-chunking";
 //#region extensions/whatsapp/src/outbound-adapter.ts
 let whatsAppSendModulePromise;
 function loadWhatsAppSendModule() {
-	whatsAppSendModulePromise ??= import("./send-CiXxYtQ_.js").then((n) => n.a);
+	whatsAppSendModulePromise ??= import("./send-E_kMiuZP.js").then((n) => n.a);
 	return whatsAppSendModulePromise;
 }
 function normalizeOutboundText(text) {

package/dist/{outbound-base-BCEEnbqz.js → outbound-base-E84SMkd9.js}

@@ -1,4 +1,4 @@
-import { n as normalizeWhatsAppPayloadText, t as normalizeWhatsAppOutboundPayload } from "./outbound-media-contract-Dk324Pce.js";
+import { n as normalizeWhatsAppPayloadText, t as normalizeWhatsAppOutboundPayload } from "./outbound-media-contract-ioTkt8tn.js";
 import { p as toWhatsappJid } from "./text-runtime-Dk37KYHj.js";
 import { i as lookupInboundMessageMetaForTarget } from "./quoted-message-CveINB35.js";
 import { DEFAULT_ACCOUNT_ID, listCombinedAccountIds, normalizeOptionalAccountId, resolveListedDefaultAccountId } from "openclaw/plugin-sdk/account-core";

package/dist/outbound-payload-test-api.js

@@ -1,2 +1,2 @@
-import { t as whatsappOutbound } from "./outbound-adapter-AQXm0jeQ.js";
+import { t as whatsappOutbound } from "./outbound-adapter-ltiZkW9L.js";
 export { whatsappOutbound };

package/dist/runtime-api.js

@@ -1,16 +1,16 @@
-import { n as resolveWebCredsBackupPath, r as resolveWebCredsPath, t as hasWebCredsSync } from "./creds-files-D9VwL4Az.js";
-import { n as whatsAppActionRuntime, t as handleWhatsAppAction } from "./action-runtime-Up8OrLd_.js";
+import { o as resolveWebCredsBackupPath, r as hasWebCredsSync, s as resolveWebCredsPath } from "./creds-files-B1kSWtBg.js";
+import { n as whatsAppActionRuntime, t as handleWhatsAppAction } from "./action-runtime-D4UqEXqf.js";
 import { n as getStatusCode, t as formatError } from "./session-errors-BAj9D2La.js";
-import { i as sendTypingWhatsApp, n as sendPollWhatsApp, r as sendReactionWhatsApp, t as sendMessageWhatsApp } from "./send-CiXxYtQ_.js";
+import { i as sendTypingWhatsApp, n as sendPollWhatsApp, r as sendReactionWhatsApp, t as sendMessageWhatsApp } from "./send-E_kMiuZP.js";
 import { startWebLoginWithQr, waitForWebLogin } from "./login-qr-runtime.js";
-import { t as createWhatsAppLoginTool } from "./agent-tools-login-EtLHKziO.js";
+import { t as createWhatsAppLoginTool } from "./agent-tools-login-BDzvb3ee.js";
 import { n as setWhatsAppRuntime } from "./runtime-CboC4QhQ.js";
-import { C as waitForCredsSaveQueue, T as writeCredsJsonAtomically, _ as readWebSelfIdentity, a as formatWhatsAppWebAuthStatusState, b as restoreCredsFromBackupIfNeeded, c as logoutWeb, d as readWebAuthExistsBestEffort, f as readWebAuthExistsForDecision, g as readWebSelfId, h as readWebAuthState, l as pickWebChannel, m as readWebAuthSnapshotBestEffort, n as WHATSAPP_AUTH_UNSTABLE_CODE, o as getWebAuthAgeMs, p as readWebAuthSnapshot, r as WhatsAppAuthUnstableError, s as logWebSelfId, t as WA_WEB_AUTH_DIR, u as readCredsJsonRaw, v as readWebSelfIdentityForDecision, w as waitForCredsSaveQueueWithTimeout, x as webAuthExists, y as resolveDefaultWebAuthDir } from "./auth-store-C-5icsdY.js";
+import { C as waitForCredsSaveQueue, T as writeCredsJsonAtomically, _ as readWebSelfIdentity, a as formatWhatsAppWebAuthStatusState, b as restoreCredsFromBackupIfNeeded, c as logoutWeb, d as readWebAuthExistsBestEffort, f as readWebAuthExistsForDecision, g as readWebSelfId, h as readWebAuthState, l as pickWebChannel, m as readWebAuthSnapshotBestEffort, n as WHATSAPP_AUTH_UNSTABLE_CODE, o as getWebAuthAgeMs, p as readWebAuthSnapshot, r as WhatsAppAuthUnstableError, s as logWebSelfId, t as WA_WEB_AUTH_DIR, u as readCredsJsonRaw, v as readWebSelfIdentityForDecision, w as waitForCredsSaveQueueWithTimeout, x as webAuthExists, y as resolveDefaultWebAuthDir } from "./auth-store-GTQvJznL.js";
 import { t as DEFAULT_WEB_MEDIA_BYTES } from "./constants-HU41RHGI.js";
-import { c as extractContactContext, d as extractMediaPlaceholder, p as extractText, u as extractLocationData } from "./send-api-CcNZTwSs.js";
-import { n as newConnectionId, r as waitForWaConnection, t as createWaSocket } from "./session-Bn5i1Fqp.js";
+import { c as extractContactContext, d as extractMediaPlaceholder, p as extractText, u as extractLocationData } from "./send-api-CXPUXbUL.js";
+import { n as newConnectionId, r as waitForWaConnection, t as createWaSocket } from "./session-CPsgRMMa.js";
 import { n as resolveWebAccountId, t as getActiveWebListener } from "./active-listener-B4SDebQ6.js";
-import { a as loadWebMediaRaw, c as monitorWebInbox, i as loadWebMedia, l as resetWebInboundDedupe, n as LocalMediaAccessError, o as optimizeImageToJpeg, r as getDefaultLocalRoots, s as optimizeImageToPng, t as monitorWebChannel } from "./monitor-DYvWelW5.js";
-import { t as loginWeb } from "./login-CGOtBPVS.js";
+import { a as loadWebMediaRaw, c as monitorWebInbox, i as loadWebMedia, l as resetWebInboundDedupe, n as LocalMediaAccessError, o as optimizeImageToJpeg, r as getDefaultLocalRoots, s as optimizeImageToPng, t as monitorWebChannel } from "./monitor-Dw2i5QSQ.js";
+import { t as loginWeb } from "./login-nJwaNuC-.js";
 import { HEARTBEAT_PROMPT, HEARTBEAT_TOKEN, SILENT_REPLY_TOKEN, stripHeartbeatToken } from "openclaw/plugin-sdk/reply-runtime";
 export { DEFAULT_WEB_MEDIA_BYTES, HEARTBEAT_PROMPT, HEARTBEAT_TOKEN, LocalMediaAccessError, SILENT_REPLY_TOKEN, WA_WEB_AUTH_DIR, WHATSAPP_AUTH_UNSTABLE_CODE, WhatsAppAuthUnstableError, createWaSocket, createWhatsAppLoginTool, extractContactContext, extractLocationData, extractMediaPlaceholder, extractText, formatError, formatWhatsAppWebAuthStatusState, getActiveWebListener, getDefaultLocalRoots, getStatusCode, getWebAuthAgeMs, handleWhatsAppAction, hasWebCredsSync, loadWebMedia, loadWebMediaRaw, logWebSelfId, loginWeb, logoutWeb, monitorWebChannel, monitorWebInbox, newConnectionId, optimizeImageToJpeg, optimizeImageToPng, pickWebChannel, readCredsJsonRaw, readWebAuthExistsBestEffort, readWebAuthExistsForDecision, readWebAuthSnapshot, readWebAuthSnapshotBestEffort, readWebAuthState, readWebSelfId, readWebSelfIdentity, readWebSelfIdentityForDecision, resetWebInboundDedupe, resolveDefaultWebAuthDir, resolveWebAccountId, resolveWebCredsBackupPath, resolveWebCredsPath, restoreCredsFromBackupIfNeeded, sendMessageWhatsApp, sendPollWhatsApp, sendReactionWhatsApp, sendTypingWhatsApp, setWhatsAppRuntime, startWebLoginWithQr, stripHeartbeatToken, waitForCredsSaveQueue, waitForCredsSaveQueueWithTimeout, waitForWaConnection, waitForWebLogin, webAuthExists, whatsAppActionRuntime, writeCredsJsonAtomically };

package/dist/{send-CiXxYtQ_.js → send-E_kMiuZP.js}

@@ -1,9 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { r as resolveDefaultWhatsAppAccountId } from "./account-ids-CB5SOWjc.js";
-import { a as resolveWhatsAppAccount, s as resolveWhatsAppMediaMaxBytes } from "./accounts-DskwwYAM.js";
+import { a as resolveWhatsAppAccount, s as resolveWhatsAppMediaMaxBytes } from "./accounts-BPYgj8Fv.js";
 import { n as isWhatsAppNewsletterJid } from "./normalize-target-bVWjgftN.js";
 import { t as getRegisteredWhatsAppConnectionController } from "./connection-controller-registry-TSX_udJp.js";
-import { a as resolveWhatsAppOutboundMediaUrls, i as prepareWhatsAppOutboundMedia, n as normalizeWhatsAppPayloadText, s as resolveWhatsAppDocumentFileName } from "./outbound-media-contract-Dk324Pce.js";
+import { a as resolveWhatsAppOutboundMediaUrls, i as prepareWhatsAppOutboundMedia, n as normalizeWhatsAppPayloadText, s as resolveWhatsAppDocumentFileName } from "./outbound-media-contract-ioTkt8tn.js";
 import "./normalize-Bxwqo-bW.js";
 import { d as markdownToWhatsApp, p as toWhatsappJid } from "./text-runtime-Dk37KYHj.js";
 import { formatCliCommand } from "openclaw/plugin-sdk/cli-runtime";

package/dist/{send-api-CcNZTwSs.js → send-api-CXPUXbUL.js}

@@ -1,5 +1,5 @@
 import { n as isWhatsAppNewsletterJid } from "./normalize-target-bVWjgftN.js";
-import { s as resolveWhatsAppDocumentFileName } from "./outbound-media-contract-Dk324Pce.js";
+import { s as resolveWhatsAppDocumentFileName } from "./outbound-media-contract-ioTkt8tn.js";
 import "./normalize-Bxwqo-bW.js";
 import { m as toWhatsappJidWithLid, p as toWhatsappJid, u as jidToE164 } from "./text-runtime-Dk37KYHj.js";
 import { t as buildQuotedMessageOptions } from "./quoted-message-CveINB35.js";

package/dist/{session-Bn5i1Fqp.js → session-CPsgRMMa.js}

@@ -1,8 +1,7 @@
-import { n as resolveWebCredsBackupPath, r as resolveWebCredsPath } from "./creds-files-D9VwL4Az.js";
+import { o as resolveWebCredsBackupPath, s as resolveWebCredsPath, t as assertWebCredsPathRegularFileOrMissing } from "./creds-files-B1kSWtBg.js";
 import { n as getStatusCode } from "./session-errors-BAj9D2La.js";
-import { S as enqueueCredsSave, T as writeCredsJsonAtomically, b as restoreCredsFromBackupIfNeeded, u as readCredsJsonRaw, w as waitForCredsSaveQueueWithTimeout, y as resolveDefaultWebAuthDir } from "./auth-store-C-5icsdY.js";
+import { E as writeWebCredsRawAtomically, S as enqueueCredsSave, T as writeCredsJsonAtomically, b as restoreCredsFromBackupIfNeeded, u as readCredsJsonRaw, w as waitForCredsSaveQueueWithTimeout, y as resolveDefaultWebAuthDir } from "./auth-store-GTQvJznL.js";
 import { i as makeWASocket, n as fetchLatestBaileysVersion, o as useMultiFileAuthState, r as makeCacheableSignalKeyStore, t as DisconnectReason } from "./session.runtime-C6uBkEaI.js";
-import fs from "node:fs";
 import { VERSION, formatCliCommand } from "openclaw/plugin-sdk/cli-runtime";
 import { danger, getChildLogger, success, toPinoLikeLogger } from "openclaw/plugin-sdk/runtime-env";
 import { renderQrTerminal } from "openclaw/plugin-sdk/media-runtime";
@@ -32,6 +31,9 @@ function resolveWhatsAppSocketTiming(cfg, overrides) {
 const LOGGED_OUT_STATUS = DisconnectReason?.loggedOut ?? 401;
 const WHATSAPP_WEBSOCKET_PROXY_TARGET = "https://mmg.whatsapp.net/";
 const CREDS_FLUSH_TIMEOUT_MESSAGE = "Queued WhatsApp creds save did not finish before auth bootstrap; skipping repair and continuing with primary creds.";
+async function rejectUnsafeWebCredsPath(authDir) {
+	await assertWebCredsPathRegularFileOrMissing(resolveWebCredsPath(authDir));
+}
 function enqueueSaveCreds(authDir, saveCreds, logger) {
 	enqueueCredsSave(authDir, () => safeSaveCreds(authDir, saveCreds, logger), (err) => {
 		logger.warn({ error: String(err) }, "WhatsApp creds save queue error");
@@ -44,10 +46,11 @@ async function safeSaveCreds(authDir, saveCreds, logger) {
 		const raw = readCredsJsonRaw(credsPath);
 		if (raw) try {
 			JSON.parse(raw);
-			fs.copyFileSync(credsPath, backupPath);
-			try {
-				fs.chmodSync(backupPath, 384);
-			} catch {}
+			await writeWebCredsRawAtomically({
+				filePath: backupPath,
+				content: raw,
+				tempPrefix: ".creds.backup"
+			});
 		} catch {}
 	} catch {}
 	try {
@@ -67,10 +70,15 @@ async function printTerminalQr(qr) {
 async function createWaSocket(printQr, verbose, opts = {}) {
 	const logger = toPinoLikeLogger(getChildLogger({ module: "baileys" }, { level: verbose ? "info" : "silent" }), verbose ? "info" : "silent");
 	const authDir = resolveUserPath(opts.authDir ?? resolveDefaultWebAuthDir());
+	await rejectUnsafeWebCredsPath(authDir);
 	await ensureDir(authDir);
 	const sessionLogger = getChildLogger({ module: "web-session" });
 	if (await waitForCredsSaveQueueWithTimeout(authDir) === "timed_out") sessionLogger.warn({ authDir }, CREDS_FLUSH_TIMEOUT_MESSAGE);
-	else await restoreCredsFromBackupIfNeeded(authDir);
+	else {
+		await rejectUnsafeWebCredsPath(authDir);
+		await restoreCredsFromBackupIfNeeded(authDir);
+	}
+	await rejectUnsafeWebCredsPath(authDir);
 	const { state } = await useMultiFileAuthState(authDir);
 	const saveCreds = async () => {
 		await writeCredsJsonAtomically(authDir, state.creds);

package/dist/{setup-core-m8ba61Dp.js → setup-core-Dm1hsI3r.js}

@@ -1,5 +1,5 @@
 import { r as resolveDefaultWhatsAppAccountId, t as listAccountIds } from "./account-ids-CB5SOWjc.js";
-import { a as resolveWhatsAppAccount, n as hasAnyWhatsAppAuth } from "./accounts-DskwwYAM.js";
+import { a as resolveWhatsAppAccount, n as hasAnyWhatsAppAuth } from "./accounts-BPYgj8Fv.js";
 import { a as normalizeWhatsAppAllowFromEntries } from "./normalize-target-bVWjgftN.js";
 import { t as WhatsAppChannelConfigSchema } from "./config-schema-CsNDlDpL.js";
 import { n as whatsappDoctor } from "./doctor-By3SB4lm.js";
@@ -125,10 +125,10 @@ function resolveWhatsAppConfigPath(params) {
 	return `${resolveWhatsAppGroupScopeBasePath(params)}.${params.field}`;
 }
 async function loadWhatsAppChannelRuntime() {
-	return await import("./channel.runtime-CvfJiuex.js");
+	return await import("./channel.runtime-BBPZSziE.js");
 }
 async function loadWhatsAppSetupSurface() {
-	return await import("./setup-surface-D4sy0_LW.js");
+	return await import("./setup-surface-DqY0LqAY.js");
 }
 const whatsappSetupWizardProxy = createWhatsAppSetupWizardProxy(async () => (await loadWhatsAppSetupSurface()).whatsappSetupWizard);
 const whatsappConfigAdapter = createScopedChannelConfigAdapter({

package/dist/{setup-finalize-Du-2MqfD.js → setup-finalize-BlTQrUj9.js}

@@ -1,9 +1,9 @@
 import { r as resolveDefaultWhatsAppAccountId } from "./account-ids-CB5SOWjc.js";
-import { a as resolveWhatsAppAccount, o as resolveWhatsAppAuthDir } from "./accounts-DskwwYAM.js";
+import { r as hasWebCredsSync } from "./creds-files-B1kSWtBg.js";
+import { a as resolveWhatsAppAccount, o as resolveWhatsAppAuthDir } from "./accounts-BPYgj8Fv.js";
 import { a as normalizeWhatsAppAllowFromEntries, o as normalizeWhatsAppAllowFromEntry } from "./normalize-target-bVWjgftN.js";
-import { t as whatsappSetupAdapter } from "./setup-core-m8ba61Dp.js";
-import path from "node:path";
-import { DEFAULT_ACCOUNT_ID, createSetupTranslator, pathExists, splitSetupEntries } from "openclaw/plugin-sdk/setup";
+import { t as whatsappSetupAdapter } from "./setup-core-Dm1hsI3r.js";
+import { DEFAULT_ACCOUNT_ID, createSetupTranslator, splitSetupEntries } from "openclaw/plugin-sdk/setup";
 import { formatCliCommand, formatDocsLink } from "openclaw/plugin-sdk/setup-tools";
 //#region extensions/whatsapp/src/setup-finalize.ts
 const t = createSetupTranslator();
@@ -89,7 +89,7 @@ async function detectWhatsAppLinked(cfg, accountId) {
 		cfg,
 		accountId
 	});
-	return await pathExists(path.join(authDir, "creds.json"));
+	return hasWebCredsSync(authDir);
 }
 async function promptWhatsAppOwnerAllowFrom(params) {
 	const { prompter, existingAllowFrom } = params;
@@ -280,7 +280,7 @@ async function finalizeWhatsAppSetup(params) {
 		message: linked ? t("wizard.whatsapp.relinkPrompt") : t("wizard.whatsapp.linkNowPrompt"),
 		initialValue: !linked
 	})) try {
-		const { loginWeb } = await import("./login-CGOtBPVS.js").then((n) => n.n);
+		const { loginWeb } = await import("./login-nJwaNuC-.js").then((n) => n.n);
 		await loginWeb(false, void 0, params.runtime, accountId);
 	} catch (error) {
 		params.runtime.error(`WhatsApp login failed: ${String(error)}`);

package/dist/setup-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as whatsappSetupPlugin } from "./channel.setup-CBHtRTDw.js";
+import { t as whatsappSetupPlugin } from "./channel.setup-BDH3Mk5M.js";
 export { whatsappSetupPlugin };

package/dist/{setup-surface-D4sy0_LW.js → setup-surface-DqY0LqAY.js}

@@ -1,6 +1,6 @@
 import { t as listAccountIds } from "./account-ids-CB5SOWjc.js";
-import { o as resolveWhatsAppAuthDir } from "./accounts-DskwwYAM.js";
-import { a as formatWhatsAppWebAuthStatusState, h as readWebAuthState } from "./auth-store-C-5icsdY.js";
+import { o as resolveWhatsAppAuthDir } from "./accounts-BPYgj8Fv.js";
+import { a as formatWhatsAppWebAuthStatusState, h as readWebAuthState } from "./auth-store-GTQvJznL.js";
 import { DEFAULT_ACCOUNT_ID, createSetupTranslator, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
 //#region extensions/whatsapp/src/setup-surface.ts
 const t = createSetupTranslator();
@@ -36,7 +36,7 @@ const whatsappSetupWizard = {
 	},
 	resolveShouldPromptAccountIds: ({ shouldPromptAccountIds }) => shouldPromptAccountIds,
 	credentials: [],
-	finalize: async (params) => await (await import("./setup-finalize-Du-2MqfD.js")).finalizeWhatsAppSetup(params),
+	finalize: async (params) => await (await import("./setup-finalize-BlTQrUj9.js")).finalizeWhatsAppSetup(params),
 	disable: (cfg) => setSetupChannelEnabled(cfg, channel, false),
 	onAccountRecorded: (accountId, options) => {
 		options?.onAccountId?.(channel, accountId);

package/dist/test-api.js

@@ -1,3 +1,3 @@
 import { t as resolveWhatsAppRuntimeGroupPolicy } from "./runtime-group-policy-DeSRFXEV.js";
-import { t as whatsappOutbound } from "./outbound-adapter-AQXm0jeQ.js";
+import { t as whatsappOutbound } from "./outbound-adapter-ltiZkW9L.js";
 export { resolveWhatsAppRuntimeGroupPolicy, whatsappOutbound };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/whatsapp",
-  "version": "2026.5.20-beta.1",
+  "version": "2026.5.20",
   "description": "OpenClaw WhatsApp channel plugin",
   "repository": {
     "type": "git",
@@ -19,7 +19,7 @@
     "openclaw": "workspace:*"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.5.20-beta.1"
+    "openclaw": ">=2026.5.20"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -62,10 +62,10 @@
       "minHostVersion": ">=2026.4.25"
     },
     "compat": {
-      "pluginApi": ">=2026.5.20-beta.1"
+      "pluginApi": ">=2026.5.20"
     },
     "build": {
-      "openclawVersion": "2026.5.20-beta.1"
+      "openclawVersion": "2026.5.20"
     },
     "release": {
       "publishToClawHub": true,

package/dist/creds-files-D9VwL4Az.js

@@ -1,19 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-//#region extensions/whatsapp/src/creds-files.ts
-function resolveWebCredsPath(authDir) {
-	return path.join(authDir, "creds.json");
-}
-function resolveWebCredsBackupPath(authDir) {
-	return path.join(authDir, "creds.json.bak");
-}
-function hasWebCredsSync(authDir) {
-	try {
-		const stats = fs.statSync(resolveWebCredsPath(authDir));
-		return stats.isFile() && stats.size > 1;
-	} catch {
-		return false;
-	}
-}
-//#endregion
-export { resolveWebCredsBackupPath as n, resolveWebCredsPath as r, hasWebCredsSync as t };

package/dist/{outbound-media-contract-Dk324Pce.js → outbound-media-contract-ioTkt8tn.js}

@@ -1,10 +1,10 @@
 import { t as formatError } from "./session-errors-BAj9D2La.js";
 import { a as sanitizeAssistantVisibleTextWithProfile, i as sanitizeAssistantVisibleText, o as sleep, s as stripToolCallXmlTags } from "./text-runtime-Dk37KYHj.js";
 import path from "node:path";
+import { writeExternalFileWithinRoot } from "openclaw/plugin-sdk/security-runtime";
 import { extensionForMime } from "openclaw/plugin-sdk/media-mime";
 import { MEDIA_FFMPEG_MAX_AUDIO_DURATION_SECS, runFfmpeg } from "openclaw/plugin-sdk/media-runtime";
 import { sanitizeForPlainText } from "openclaw/plugin-sdk/outbound-runtime";
-import { writeExternalFileWithinRoot } from "openclaw/plugin-sdk/security-runtime";
 import { resolvePreferredOpenClawTmpDir, withTempWorkspace } from "openclaw/plugin-sdk/temp-path";
 //#region extensions/whatsapp/src/document-filename.ts
 const WHATSAPP_DEFAULT_DOCUMENT_FILE_NAME = "file";