@openclaw/whatsapp 2026.5.7 → 2026.5.10-beta.1

package/dist/{access-control-CTj7P7WP.js → access-control-CdP8S3rJ.js}

@@ -1,15 +1,20 @@
+import { r as isSelfChatMode, t as text_runtime_exports } from "./text-runtime-DBKC9uEi.js";
 import { a as resolveWhatsAppAccount } from "./accounts-BDqgpFEB.js";
-import { r as isSelfChatMode, t as text_runtime_exports } from "./text-runtime-DFFwk5z6.js";
-import { a as getSelfIdentity, o as getSenderIdentity } from "./identity-DhaC0MoD.js";
-import { t as resolveWhatsAppRuntimeGroupPolicy } from "./runtime-group-policy-Gp1lQ0at.js";
+import { a as getSelfIdentity, o as getSenderIdentity } from "./identity-KxdJfH7p.js";
+import { t as resolveWhatsAppRuntimeGroupPolicy } from "./runtime-group-policy-BH_U23qp.js";
 import { defaultRuntime } from "openclaw/plugin-sdk/runtime-env";
 import { resolveChannelGroupPolicy, resolveChannelGroupRequireMention } from "openclaw/plugin-sdk/channel-policy";
 import { createChannelPairingChallengeIssuer } from "openclaw/plugin-sdk/channel-pairing";
 import { upsertChannelPairingRequest } from "openclaw/plugin-sdk/conversation-runtime";
 import { resolveDefaultGroupPolicy, warnMissingProviderGroupPolicyFallbackOnce } from "openclaw/plugin-sdk/runtime-group-policy";
-import { expandAllowFromWithAccessGroups, readStoreAllowFromForDmPolicy, resolveDmGroupAccessWithCommandGate, resolveDmGroupAccessWithLists, resolveEffectiveAllowFromLists } from "openclaw/plugin-sdk/security-runtime";
+import { resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { resolveGroupSessionKey } from "openclaw/plugin-sdk/session-store-runtime";
 //#region extensions/whatsapp/src/inbound-policy.ts
+function normalizeWhatsAppIngressPhone(value) {
+	const trimmed = value.trim();
+	if (!trimmed) return null;
+	return (0, text_runtime_exports.normalizeE164)(trimmed);
+}
 function resolveGroupConversationId(conversationId) {
 	return resolveGroupSessionKey({
 		From: conversationId,
@@ -17,11 +22,9 @@ function resolveGroupConversationId(conversationId) {
 		Provider: "whatsapp"
 	})?.id ?? conversationId;
 }
-function isNormalizedSenderAllowed(allowEntries, sender) {
-	if (allowEntries.includes("*")) return true;
-	const normalizedSender = (0, text_runtime_exports.normalizeE164)(sender ?? "");
-	if (!normalizedSender) return false;
-	return new Set(allowEntries.map((entry) => (0, text_runtime_exports.normalizeE164)(entry)).filter((entry) => Boolean(entry))).has(normalizedSender);
+function maybeSamePhoneDmAllowFrom(params) {
+	if (params.isGroup || !params.dmSenderId || !params.policy.isSamePhone(params.dmSenderId)) return [];
+	return [params.dmSenderId];
 }
 function buildResolvedWhatsAppGroupConfig(params) {
 	return { channels: { whatsapp: {
@@ -37,11 +40,7 @@ function resolveWhatsAppInboundPolicy(params) {
 	const configuredAllowFrom = account.allowFrom ?? [];
 	const dmPolicy = account.dmPolicy ?? "pairing";
 	const dmAllowFrom = configuredAllowFrom.length > 0 ? configuredAllowFrom : params.selfE164 ? [params.selfE164] : [];
-	const groupAllowFrom = account.groupAllowFrom ?? (configuredAllowFrom.length > 0 ? configuredAllowFrom : void 0) ?? [];
-	const { effectiveGroupAllowFrom } = resolveEffectiveAllowFromLists({
-		allowFrom: configuredAllowFrom,
-		groupAllowFrom
-	});
+	const groupAllowFrom = (Array.isArray(account.groupAllowFrom) && account.groupAllowFrom.length > 0 ? account.groupAllowFrom : void 0) ?? (configuredAllowFrom.length > 0 ? configuredAllowFrom : void 0) ?? [];
 	const defaultGroupPolicy = resolveDefaultGroupPolicy(params.cfg);
 	const { groupPolicy, providerMissingFallbackApplied } = resolveWhatsAppRuntimeGroupPolicy({
 		providerConfigPresent: params.cfg.channels?.whatsapp !== void 0,
@@ -62,15 +61,12 @@ function resolveWhatsAppInboundPolicy(params) {
 		groupAllowFrom,
 		isSelfChat: account.selfChatMode ?? isSelfChatMode(params.selfE164, configuredAllowFrom),
 		providerMissingFallbackApplied,
-		shouldReadStorePairingApprovals: dmPolicy !== "allowlist",
 		isSamePhone,
-		isDmSenderAllowed: (allowEntries, sender) => isSamePhone(sender) || isNormalizedSenderAllowed(allowEntries, sender),
-		isGroupSenderAllowed: (allowEntries, sender) => isNormalizedSenderAllowed(allowEntries, sender),
 		resolveConversationGroupPolicy: (conversationId) => resolveChannelGroupPolicy({
 			cfg: resolvedGroupCfg,
 			channel: "whatsapp",
 			groupId: resolveGroupConversationId(conversationId),
-			hasGroupAllowFrom: effectiveGroupAllowFrom.length > 0
+			hasGroupAllowFrom: groupAllowFrom.length > 0
 		}),
 		resolveConversationRequireMention: (conversationId) => resolveChannelGroupRequireMention({
 			cfg: resolvedGroupCfg,
@@ -79,9 +75,40 @@ function resolveWhatsAppInboundPolicy(params) {
 		})
 	};
 }
+async function resolveWhatsAppIngressAccess(params) {
+	const samePhoneDmAllowFrom = maybeSamePhoneDmAllowFrom({
+		isGroup: params.isGroup,
+		policy: params.policy,
+		dmSenderId: params.dmSenderId
+	});
+	const dmAllowFrom = [...params.policy.dmAllowFrom, ...samePhoneDmAllowFrom];
+	return await resolveStableChannelMessageIngress({
+		channelId: "whatsapp",
+		accountId: params.policy.account.accountId,
+		identity: {
+			key: "whatsapp-sender-phone",
+			kind: "phone",
+			normalize: normalizeWhatsAppIngressPhone,
+			sensitivity: "pii",
+			entryIdPrefix: "whatsapp-entry"
+		},
+		cfg: params.cfg,
+		useDefaultPairingStore: true,
+		subject: { stableId: params.senderId ?? "" },
+		conversation: {
+			kind: params.isGroup ? "group" : "direct",
+			id: params.conversationId
+		},
+		dmPolicy: params.policy.dmPolicy,
+		groupPolicy: params.policy.groupPolicy,
+		policy: { groupAllowFromFallbackToAllowFrom: false },
+		allowFrom: dmAllowFrom,
+		groupAllowFrom: params.policy.groupAllowFrom,
+		command: params.includeCommand === true ? {} : void 0
+	});
+}
 async function resolveWhatsAppCommandAuthorized(params) {
-	const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
-	if (!useAccessGroups) return true;
+	if (!(params.cfg.commands?.useAccessGroups !== false)) return true;
 	const self = getSelfIdentity(params.msg);
 	const policy = params.policy ?? resolveWhatsAppInboundPolicy({
 		cfg: params.cfg,
@@ -92,52 +119,16 @@ async function resolveWhatsAppCommandAuthorized(params) {
 	const sender = getSenderIdentity(params.msg);
 	const dmSender = sender.e164 ?? params.msg.from ?? "";
 	const groupSender = sender.e164 ?? "";
-	const normalizedSender = (0, text_runtime_exports.normalizeE164)(isGroup ? groupSender : dmSender);
-	if (!normalizedSender) return false;
-	const storeAllowFrom = isGroup || !policy.shouldReadStorePairingApprovals ? [] : await readStoreAllowFromForDmPolicy({
-		provider: "whatsapp",
-		accountId: policy.account.accountId,
-		dmPolicy: policy.dmPolicy,
-		shouldRead: policy.shouldReadStorePairingApprovals
-	});
-	const isSenderAllowed = (senderId, allowEntries) => isGroup ? policy.isGroupSenderAllowed(allowEntries, senderId) : policy.isDmSenderAllowed(allowEntries, senderId);
-	const [allowFrom, groupAllowFrom] = await Promise.all([expandAllowFromWithAccessGroups({
-		cfg: params.cfg,
-		allowFrom: policy.dmAllowFrom,
-		channel: "whatsapp",
-		accountId: policy.account.accountId,
-		senderId: normalizedSender,
-		isSenderAllowed
-	}), expandAllowFromWithAccessGroups({
+	if (!(0, text_runtime_exports.normalizeE164)(isGroup ? groupSender : dmSender)) return false;
+	return (await resolveWhatsAppIngressAccess({
 		cfg: params.cfg,
-		allowFrom: policy.groupAllowFrom,
-		channel: "whatsapp",
-		accountId: policy.account.accountId,
-		senderId: normalizedSender,
-		isSenderAllowed
-	})]);
-	const dmStoreAllowFrom = isGroup ? [] : await expandAllowFromWithAccessGroups({
-		cfg: params.cfg,
-		allowFrom: storeAllowFrom,
-		channel: "whatsapp",
-		accountId: policy.account.accountId,
-		senderId: normalizedSender,
-		isSenderAllowed
-	});
-	return resolveDmGroupAccessWithCommandGate({
+		policy,
 		isGroup,
-		dmPolicy: policy.dmPolicy,
-		groupPolicy: policy.groupPolicy,
-		allowFrom,
-		groupAllowFrom,
-		storeAllowFrom: dmStoreAllowFrom,
-		isSenderAllowed: (allowEntries) => isGroup ? policy.isGroupSenderAllowed(allowEntries, groupSender) : policy.isDmSenderAllowed(allowEntries, dmSender),
-		command: {
-			useAccessGroups,
-			allowTextCommands: true,
-			hasControlCommand: true
-		}
-	}).commandAuthorized;
+		conversationId: params.msg.conversationId ?? params.msg.chatId ?? params.msg.from,
+		senderId: isGroup ? groupSender : dmSender,
+		dmSenderId: dmSender,
+		includeCommand: true
+	})).commandAccess.authorized;
 }
 //#endregion
 //#region extensions/whatsapp/src/inbound/access-control.ts
@@ -152,12 +143,6 @@ async function checkInboundAccessControl(params) {
 		accountId: params.accountId,
 		selfE164: params.selfE164
 	});
-	const storeAllowFrom = params.group ? [] : await readStoreAllowFromForDmPolicy({
-		provider: "whatsapp",
-		accountId: policy.account.accountId,
-		dmPolicy: policy.dmPolicy,
-		shouldRead: policy.shouldReadStorePairingApprovals
-	});
 	const pairingGraceMs = typeof params.pairingGraceMs === "number" && params.pairingGraceMs > 0 ? params.pairingGraceMs : PAIRING_REPLY_HISTORY_GRACE_MS;
 	const suppressPairingReply = typeof params.connectedAtMs === "number" && typeof params.messageTimestampMs === "number" && params.messageTimestampMs < params.connectedAtMs - pairingGraceMs;
 	warnMissingProviderGroupPolicyFallbackOnce({
@@ -166,47 +151,17 @@ async function checkInboundAccessControl(params) {
 		accountId: policy.account.accountId,
 		log: (message) => logWhatsAppVerbose(params.verbose, message)
 	});
-	const accessGroupSenderId = params.group ? params.senderE164 ?? params.from : params.from;
-	const isAccessGroupSenderAllowed = (senderId, allowEntries) => {
-		return params.group ? policy.isGroupSenderAllowed(allowEntries, senderId) : policy.isDmSenderAllowed(allowEntries, senderId);
-	};
-	const [allowFrom, groupAllowFrom] = await Promise.all([expandAllowFromWithAccessGroups({
-		cfg: params.cfg,
-		allowFrom: params.group ? policy.configuredAllowFrom : policy.dmAllowFrom,
-		channel: "whatsapp",
-		accountId: policy.account.accountId,
-		senderId: accessGroupSenderId,
-		isSenderAllowed: isAccessGroupSenderAllowed
-	}), expandAllowFromWithAccessGroups({
+	const { senderAccess } = await resolveWhatsAppIngressAccess({
 		cfg: params.cfg,
-		allowFrom: policy.groupAllowFrom,
-		channel: "whatsapp",
-		accountId: policy.account.accountId,
-		senderId: accessGroupSenderId,
-		isSenderAllowed: isAccessGroupSenderAllowed
-	})]);
-	const dmStoreAllowFrom = params.group ? [] : await expandAllowFromWithAccessGroups({
-		cfg: params.cfg,
-		allowFrom: storeAllowFrom,
-		channel: "whatsapp",
-		accountId: policy.account.accountId,
-		senderId: accessGroupSenderId,
-		isSenderAllowed: isAccessGroupSenderAllowed
-	});
-	const access = resolveDmGroupAccessWithLists({
+		policy,
 		isGroup: params.group,
-		dmPolicy: policy.dmPolicy,
-		groupPolicy: policy.groupPolicy,
-		allowFrom,
-		groupAllowFrom,
-		storeAllowFrom: dmStoreAllowFrom,
-		isSenderAllowed: (allowEntries) => {
-			return params.group ? policy.isGroupSenderAllowed(allowEntries, params.senderE164) : policy.isDmSenderAllowed(allowEntries, params.from);
-		}
+		conversationId: params.remoteJid,
+		senderId: params.group ? params.senderE164 : params.from,
+		dmSenderId: params.from
 	});
-	if (params.group && access.decision !== "allow") {
-		if (access.reason === "groupPolicy=disabled") logWhatsAppVerbose(params.verbose, "Blocked group message (groupPolicy: disabled)");
-		else if (access.reason === "groupPolicy=allowlist (empty allowlist)") logWhatsAppVerbose(params.verbose, "Blocked group message (groupPolicy: allowlist, no groupAllowFrom)");
+	if (params.group && senderAccess.decision !== "allow") {
+		if (senderAccess.reasonCode === "group_policy_disabled") logWhatsAppVerbose(params.verbose, "Blocked group message (groupPolicy: disabled)");
+		else if (senderAccess.reasonCode === "group_policy_empty_allowlist") logWhatsAppVerbose(params.verbose, "Blocked group message (groupPolicy: allowlist, no groupAllowFrom)");
 		else logWhatsAppVerbose(params.verbose, `Blocked group message from ${params.senderE164 ?? "unknown sender"} (groupPolicy: allowlist)`);
 		return {
 			allowed: false,
@@ -225,7 +180,7 @@ async function checkInboundAccessControl(params) {
 				resolvedAccountId: policy.account.accountId
 			};
 		}
-		if (access.decision === "block" && access.reason === "dmPolicy=disabled") {
+		if (senderAccess.decision === "block" && senderAccess.reasonCode === "dm_policy_disabled") {
 			logWhatsAppVerbose(params.verbose, "Blocked dm (dmPolicy: disabled)");
 			return {
 				allowed: false,
@@ -234,7 +189,7 @@ async function checkInboundAccessControl(params) {
 				resolvedAccountId: policy.account.accountId
 			};
 		}
-		if (access.decision === "pairing" && !policy.isSamePhone(params.from)) {
+		if (senderAccess.decision === "pairing" && !policy.isSamePhone(params.from)) {
 			const candidate = params.from;
 			if (suppressPairingReply) logWhatsAppVerbose(params.verbose, `Skipping pairing reply for historical DM from ${candidate}.`);
 			else await createChannelPairingChallengeIssuer({
@@ -266,7 +221,7 @@ async function checkInboundAccessControl(params) {
 				resolvedAccountId: policy.account.accountId
 			};
 		}
-		if (access.decision !== "allow") {
+		if (senderAccess.decision !== "allow") {
 			logWhatsAppVerbose(params.verbose, `Blocked unauthorized sender ${params.from} (dmPolicy=${policy.dmPolicy})`);
 			return {
 				allowed: false,

package/dist/{action-runtime-BqYZmBX_.js → action-runtime-CMhO8liB.js}

@@ -1,7 +1,7 @@
 import { a as resolveWhatsAppAccount } from "./accounts-BDqgpFEB.js";
 import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-CQ3Y1i0g.js";
 import { t as resolveWhatsAppReactionLevel } from "./reaction-level-CRVEVAfi.js";
-import { r as sendReactionWhatsApp } from "./send-CxctcFGT.js";
+import { r as sendReactionWhatsApp } from "./send-u88yh8Hw.js";
 import { ToolAuthorizationError, createActionGate, jsonResult, readReactionParams, readStringParam } from "openclaw/plugin-sdk/channel-actions";
 //#region extensions/whatsapp/src/action-runtime-target-auth.ts
 function resolveAuthorizedWhatsAppOutboundTarget(params) {

package/dist/action-runtime-api.js

@@ -1,2 +1,2 @@
-import { t as handleWhatsAppAction } from "./action-runtime-BqYZmBX_.js";
+import { t as handleWhatsAppAction } from "./action-runtime-CMhO8liB.js";
 export { handleWhatsAppAction };

package/dist/action-runtime.runtime.js

@@ -1,2 +1,2 @@
-import { t as handleWhatsAppAction } from "./action-runtime-BqYZmBX_.js";
+import { t as handleWhatsAppAction } from "./action-runtime-CMhO8liB.js";
 export { handleWhatsAppAction };

package/dist/api.js

@@ -1,23 +1,131 @@
+import { a as markdownToWhatsApp, i as jidToE164, n as assertWebChannel, o as resolveJidToE164, r as isSelfChatMode, s as toWhatsappJid, t as text_runtime_exports } from "./text-runtime-DBKC9uEi.js";
 import { r as resolveDefaultWhatsAppAccountId, t as listAccountIds } from "./account-ids-DG18xddX.js";
 import { a as resolveWhatsAppAccount, i as listWhatsAppAuthDirs, n as hasAnyWhatsAppAuth, o as resolveWhatsAppAuthDir, r as listEnabledWhatsAppAccounts, s as resolveWhatsAppMediaMaxBytes, t as DEFAULT_WHATSAPP_MEDIA_MAX_MB } from "./accounts-BDqgpFEB.js";
 import { a as normalizeWhatsAppAllowFromEntries, c as normalizeWhatsAppTarget, i as looksLikeWhatsAppTargetId, r as isWhatsAppUserTarget, s as normalizeWhatsAppMessagingTarget, t as isWhatsAppGroupJid } from "./normalize-target-nXxC_hxG.js";
 import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-CQ3Y1i0g.js";
 import "./reaction-level-CRVEVAfi.js";
-import { a as markdownToWhatsApp, i as jidToE164, n as assertWebChannel, o as resolveJidToE164, r as isSelfChatMode, s as toWhatsappJid, t as text_runtime_exports } from "./text-runtime-DFFwk5z6.js";
-import "./send-CxctcFGT.js";
-import { t as whatsappPlugin } from "./channel-CTr3YjO8.js";
-import { n as WHATSAPP_LEGACY_OUTBOUND_SEND_DEP_KEYS } from "./outbound-base-BmzhutvF.js";
-import { t as whatsappCommandPolicy } from "./command-policy-O8sRnqUV.js";
-import { a as resolveWhatsAppGroupToolPolicy, i as resolveWhatsAppGroupRequireMention, o as resolveWhatsAppGroupIntroHint } from "./shared-CTSTwprn.js";
-import "./config-schema-Dmo66Ubb.js";
-import { t as whatsappSetupPlugin } from "./channel.setup-BYtkDwHe.js";
-import { t as DEFAULT_WEB_MEDIA_BYTES } from "./constants-DLGCIbfl.js";
-import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-BNCbgnmy.js";
-import { t as __testing } from "./access-control-CTj7P7WP.js";
+import "./send-u88yh8Hw.js";
+import { t as whatsappPlugin } from "./channel-BxntAClG.js";
+import { n as WHATSAPP_LEGACY_OUTBOUND_SEND_DEP_KEYS } from "./outbound-base-MVpg2zU2.js";
+import { t as whatsappCommandPolicy } from "./command-policy-BgZRZ31o.js";
+import { a as resolveWhatsAppGroupToolPolicy, i as resolveWhatsAppGroupRequireMention, o as resolveWhatsAppGroupIntroHint } from "./shared-CgYT3IzU.js";
+import "./config-schema-cSC7M4YA.js";
+import { t as whatsappSetupPlugin } from "./channel.setup-BqlcEVzR.js";
+import { t as DEFAULT_WEB_MEDIA_BYTES } from "./constants-yKXGCGU9.js";
+import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-o-muXLgk.js";
+import { t as __testing } from "./access-control-CdP8S3rJ.js";
+import { p as extractText, t as createWebSendApi } from "./send-api-DsbCqDre.js";
+import { r as waitForWaConnection, t as createWaSocket } from "./session-DeIU_vjJ.js";
 import "openclaw/plugin-sdk/channel-actions";
 import "openclaw/plugin-sdk/account-resolution";
 import "openclaw/plugin-sdk/core";
 import "openclaw/plugin-sdk/account-id";
+//#region extensions/whatsapp/src/qa-driver.runtime.ts
+function normalizeObservedMessage(message, authDir) {
+	if (message.key.fromMe) return null;
+	const text = extractText(message.message ?? void 0);
+	if (!text) return null;
+	const fromJid = message.key.remoteJid ?? void 0;
+	return {
+		fromJid,
+		fromPhoneE164: fromJid ? jidToE164(fromJid, { authDir }) : null,
+		messageId: message.key.id ?? void 0,
+		observedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		text
+	};
+}
+function closeSocket(sock) {
+	const maybeEnd = sock.end;
+	if (typeof maybeEnd === "function") {
+		maybeEnd.call(sock);
+		return;
+	}
+	const maybeClose = sock.ws?.close;
+	if (typeof maybeClose === "function") maybeClose.call(sock.ws);
+}
+async function startWhatsAppQaDriverSession(params) {
+	const sock = await createWaSocket(false, false, { authDir: params.authDir });
+	const observedMessages = [];
+	const waiters = [];
+	let closed = false;
+	const removeWaiter = (waiter) => {
+		const index = waiters.indexOf(waiter);
+		if (index >= 0) waiters.splice(index, 1);
+		clearTimeout(waiter.timeout);
+	};
+	const observe = (message) => {
+		observedMessages.push(message);
+		for (const waiter of waiters.slice()) {
+			if (!waiter.predicate(message)) continue;
+			removeWaiter(waiter);
+			waiter.resolve(message);
+		}
+	};
+	const onMessagesUpsert = (event) => {
+		for (const rawMessage of event.messages ?? []) {
+			const observed = normalizeObservedMessage(rawMessage, params.authDir);
+			if (observed) observe(observed);
+		}
+	};
+	const removeMessageListener = () => {
+		sock.ev.off?.("messages.upsert", onMessagesUpsert);
+	};
+	const closeSessionResources = (waiterError) => {
+		if (closed) return;
+		closed = true;
+		for (const waiter of waiters.slice()) {
+			removeWaiter(waiter);
+			if (waiterError) waiter.reject(waiterError);
+		}
+		removeMessageListener();
+		closeSocket(sock);
+	};
+	sock.ev.on("messages.upsert", onMessagesUpsert);
+	let connectionTimeout;
+	try {
+		await Promise.race([waitForWaConnection(sock), new Promise((_, reject) => {
+			connectionTimeout = setTimeout(() => reject(/* @__PURE__ */ new Error("timed out waiting for WhatsApp QA driver session")), params.connectionTimeoutMs ?? 45e3);
+			connectionTimeout.unref?.();
+		})]);
+	} catch (error) {
+		closeSessionResources(error instanceof Error ? error : /* @__PURE__ */ new Error("failed starting WhatsApp QA driver session"));
+		throw error;
+	} finally {
+		if (connectionTimeout) clearTimeout(connectionTimeout);
+	}
+	const sendApi = createWebSendApi({
+		sock,
+		defaultAccountId: "qa-driver"
+	});
+	return {
+		async close() {
+			closeSessionResources(/* @__PURE__ */ new Error("WhatsApp QA driver session closed"));
+		},
+		getObservedMessages() {
+			return [...observedMessages];
+		},
+		async sendText(to, text) {
+			return { messageId: (await sendApi.sendMessage(to, text)).messageId };
+		},
+		async waitForMessage(params) {
+			const existing = observedMessages.find(params.match);
+			if (existing) return existing;
+			return await new Promise((resolve, reject) => {
+				const waiter = {
+					predicate: params.match,
+					resolve,
+					reject,
+					timeout: setTimeout(() => {
+						removeWaiter(waiter);
+						reject(/* @__PURE__ */ new Error("timed out waiting for WhatsApp QA driver message"));
+					}, params.timeoutMs)
+				};
+				waiters.push(waiter);
+			});
+		}
+	};
+}
+//#endregion
 var CONFIG_DIR = text_runtime_exports.CONFIG_DIR;
 var DEFAULT_LOG_DIR = text_runtime_exports.DEFAULT_LOG_DIR;
 var DEFAULT_LOG_FILE = text_runtime_exports.DEFAULT_LOG_FILE;
@@ -145,4 +253,4 @@ var summarizeStringEntries = text_runtime_exports.summarizeStringEntries;
 var toPinoLikeLogger = text_runtime_exports.toPinoLikeLogger;
 var truncateUtf16Safe = text_runtime_exports.truncateUtf16Safe;
 var withTimeout = text_runtime_exports.withTimeout;
-export { CONFIG_DIR, DEFAULT_LOG_DIR, DEFAULT_LOG_FILE, DEFAULT_WEB_MEDIA_BYTES, DEFAULT_WHATSAPP_MEDIA_MAX_MB, FILE_REF_EXTENSIONS_WITH_TLD, SYSTEM_MARK, WHATSAPP_LEGACY_OUTBOUND_SEND_DEP_KEYS, __test__, asNullableObjectRecord, asNullableRecord, asOptionalObjectRecord, asOptionalRecord, asRecord, assertWebChannel, bindAbortRelay, buildTimeoutAbortSignal, chunkItems, chunkMarkdownIR, clamp, clampInt, clampNumber, convertMarkdownTables, createScopedExpiringIdCache, diagnosticLogger, displayPath, displayString, ensureDir, escapeRegExp, fetchWithTimeout, findCodeRegions, getChildLogger, getDefaultRedactPatterns, getDiagnosticSessionStateCountForTest, getLogger, getResolvedLoggerSettings, hasAnyWhatsAppAuth, hasNonEmptyString, hasOrphanReasoningCloseBoundary, hasSystemMark, isAutoLinkedFileRef, isFileLogLevelEnabled, isInsideCode, isRecord, isSelfChatMode, isWhatsAppGroupJid, isWhatsAppUserTarget, jidToE164, listEnabledWhatsAppAccounts, listAccountIds as listWhatsAppAccountIds, listWhatsAppAuthDirs, listWhatsAppDirectoryGroupsFromConfig, listWhatsAppDirectoryPeersFromConfig, localeLowercasePreservingWhitespace, logActiveRuns, logDebug, logError, logInfo, logLaneDequeue, logLaneEnqueue, logMessageProcessed, logMessageQueued, logRunAttempt, logSessionStateChange, logSuccess, logToolLoopAction, logWarn, logWebhookError, logWebhookProcessed, logWebhookReceived, looksLikeWhatsAppTargetId, lowercasePreservingWhitespace, markdownToIR, markdownToIRWithMeta, markdownToWhatsApp, normalizeArrayBackedTrimmedStringList, normalizeAtHashSlug, normalizeCsvOrLooseStringList, normalizeE164, normalizeFastMode, normalizeHyphenSlug, normalizeLowercaseStringOrEmpty, normalizeNullableString, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeOptionalStringifiedId, normalizeOptionalThreadValue, normalizeOptionalTrimmedStringList, normalizeSingleOrTrimmedStringList, normalizeStringEntries, normalizeStringEntriesLower, normalizeStringifiedOptionalString, normalizeTrimmedStringList, normalizeWhatsAppAllowFromEntries, normalizeWhatsAppMessagingTarget, normalizeWhatsAppTarget, parseInlineDirectives, pathExists, prefixSystemMessage, readStringField, readStringValue, redactIdentifier, redactSensitiveLines, redactSensitiveText, redactToolDetail, renderMarkdownIRChunksWithinLimit, renderMarkdownWithMarkers, resetDiagnosticStateForTest, resetLogger, resolveConfigDir, resolveDefaultWhatsAppAccountId, resolveGlobalMap, resolveGlobalSingleton, resolveHomeDir, resolveJidToE164, resolvePrimaryStringValue, resolveReactionLevel, resolveRedactOptions, resolveStuckSessionWarnMs, resolveUserPath, resolveWhatsAppAccount, resolveWhatsAppAuthDir, resolveWhatsAppGroupIntroHint, resolveWhatsAppGroupRequireMention, resolveWhatsAppGroupToolPolicy, resolveWhatsAppMediaMaxBytes, resolveWhatsAppOutboundTarget, safeParseJson, sanitizeAssistantVisibleText, sanitizeAssistantVisibleTextWithOptions, sanitizeAssistantVisibleTextWithProfile, sanitizeReplyDirectiveId, sanitizeTerminalText, setLoggerOverride, sha256HexPrefix, shortenHomeInString, shortenHomePath, sleep, sliceMarkdownIR, sliceUtf16Safe, startDiagnosticHeartbeat, stopDiagnosticHeartbeat, stripAssistantInternalScaffolding, stripDowngradedToolCallText, stripInlineDirectiveTagsForDelivery, stripInlineDirectiveTagsForDisplay, stripInlineDirectiveTagsFromMessageForDisplay, stripMarkdown, stripMinimaxToolCallXml, stripReasoningTagsFromText, stripToolCallXmlTags, summarizeStringEntries, toPinoLikeLogger, toWhatsappJid, truncateUtf16Safe, __testing as whatsappAccessControlTesting, whatsappCommandPolicy, whatsappPlugin, whatsappSetupPlugin, withTimeout };
+export { CONFIG_DIR, DEFAULT_LOG_DIR, DEFAULT_LOG_FILE, DEFAULT_WEB_MEDIA_BYTES, DEFAULT_WHATSAPP_MEDIA_MAX_MB, FILE_REF_EXTENSIONS_WITH_TLD, SYSTEM_MARK, WHATSAPP_LEGACY_OUTBOUND_SEND_DEP_KEYS, __test__, asNullableObjectRecord, asNullableRecord, asOptionalObjectRecord, asOptionalRecord, asRecord, assertWebChannel, bindAbortRelay, buildTimeoutAbortSignal, chunkItems, chunkMarkdownIR, clamp, clampInt, clampNumber, convertMarkdownTables, createScopedExpiringIdCache, diagnosticLogger, displayPath, displayString, ensureDir, escapeRegExp, fetchWithTimeout, findCodeRegions, getChildLogger, getDefaultRedactPatterns, getDiagnosticSessionStateCountForTest, getLogger, getResolvedLoggerSettings, hasAnyWhatsAppAuth, hasNonEmptyString, hasOrphanReasoningCloseBoundary, hasSystemMark, isAutoLinkedFileRef, isFileLogLevelEnabled, isInsideCode, isRecord, isSelfChatMode, isWhatsAppGroupJid, isWhatsAppUserTarget, jidToE164, listEnabledWhatsAppAccounts, listAccountIds as listWhatsAppAccountIds, listWhatsAppAuthDirs, listWhatsAppDirectoryGroupsFromConfig, listWhatsAppDirectoryPeersFromConfig, localeLowercasePreservingWhitespace, logActiveRuns, logDebug, logError, logInfo, logLaneDequeue, logLaneEnqueue, logMessageProcessed, logMessageQueued, logRunAttempt, logSessionStateChange, logSuccess, logToolLoopAction, logWarn, logWebhookError, logWebhookProcessed, logWebhookReceived, looksLikeWhatsAppTargetId, lowercasePreservingWhitespace, markdownToIR, markdownToIRWithMeta, markdownToWhatsApp, normalizeArrayBackedTrimmedStringList, normalizeAtHashSlug, normalizeCsvOrLooseStringList, normalizeE164, normalizeFastMode, normalizeHyphenSlug, normalizeLowercaseStringOrEmpty, normalizeNullableString, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeOptionalStringifiedId, normalizeOptionalThreadValue, normalizeOptionalTrimmedStringList, normalizeSingleOrTrimmedStringList, normalizeStringEntries, normalizeStringEntriesLower, normalizeStringifiedOptionalString, normalizeTrimmedStringList, normalizeWhatsAppAllowFromEntries, normalizeWhatsAppMessagingTarget, normalizeWhatsAppTarget, parseInlineDirectives, pathExists, prefixSystemMessage, readStringField, readStringValue, redactIdentifier, redactSensitiveLines, redactSensitiveText, redactToolDetail, renderMarkdownIRChunksWithinLimit, renderMarkdownWithMarkers, resetDiagnosticStateForTest, resetLogger, resolveConfigDir, resolveDefaultWhatsAppAccountId, resolveGlobalMap, resolveGlobalSingleton, resolveHomeDir, resolveJidToE164, resolvePrimaryStringValue, resolveReactionLevel, resolveRedactOptions, resolveStuckSessionWarnMs, resolveUserPath, resolveWhatsAppAccount, resolveWhatsAppAuthDir, resolveWhatsAppGroupIntroHint, resolveWhatsAppGroupRequireMention, resolveWhatsAppGroupToolPolicy, resolveWhatsAppMediaMaxBytes, resolveWhatsAppOutboundTarget, safeParseJson, sanitizeAssistantVisibleText, sanitizeAssistantVisibleTextWithOptions, sanitizeAssistantVisibleTextWithProfile, sanitizeReplyDirectiveId, sanitizeTerminalText, setLoggerOverride, sha256HexPrefix, shortenHomeInString, shortenHomePath, sleep, sliceMarkdownIR, sliceUtf16Safe, startDiagnosticHeartbeat, startWhatsAppQaDriverSession, stopDiagnosticHeartbeat, stripAssistantInternalScaffolding, stripDowngradedToolCallText, stripInlineDirectiveTagsForDelivery, stripInlineDirectiveTagsForDisplay, stripInlineDirectiveTagsFromMessageForDisplay, stripMarkdown, stripMinimaxToolCallXml, stripReasoningTagsFromText, stripToolCallXmlTags, summarizeStringEntries, toPinoLikeLogger, toWhatsappJid, truncateUtf16Safe, __testing as whatsappAccessControlTesting, whatsappCommandPolicy, whatsappPlugin, whatsappSetupPlugin, withTimeout };

package/dist/{auth-store-BNZmNP-s.js → auth-store-CjEimXKX.js}

@@ -1,50 +1,32 @@
+import { t as text_runtime_exports } from "./text-runtime-DBKC9uEi.js";
 import { n as resolveWebCredsBackupPath, r as resolveWebCredsPath } from "./creds-files-_2V8jzQa.js";
-import { t as text_runtime_exports } from "./text-runtime-DFFwk5z6.js";
-import { c as resolveComparableIdentity } from "./identity-DhaC0MoD.js";
+import { c as resolveComparableIdentity } from "./identity-KxdJfH7p.js";
 import fs from "node:fs";
 import path from "node:path";
 import { resolveOAuthDir as resolveOAuthDir$1 } from "openclaw/plugin-sdk/state-paths";
 import { formatCliCommand } from "openclaw/plugin-sdk/cli-runtime";
 import { defaultRuntime, getChildLogger, info, success } from "openclaw/plugin-sdk/runtime-env";
+import { replaceFileAtomic } from "openclaw/plugin-sdk/security-runtime";
 import fs$1 from "node:fs/promises";
-import { randomUUID } from "node:crypto";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/routing";
 //#region extensions/whatsapp/src/creds-persistence.ts
 const CREDS_FILE_MODE = 384;
 const CREDS_SAVE_FLUSH_TIMEOUT_MS = 15e3;
 const credsSaveQueues = /* @__PURE__ */ new Map();
 async function stringifyCreds(creds) {
-	const { BufferJSON } = await import("./session.runtime-C1eSE_KK.js").then((n) => n.a);
+	const { BufferJSON } = await import("./session.runtime-B9VlYnWQ.js").then((n) => n.a);
 	return JSON.stringify(creds, BufferJSON.replacer);
 }
-async function syncDirectory(dirPath) {
-	let handle;
-	try {
-		handle = await fs$1.open(dirPath, "r");
-		await handle.sync();
-	} catch {} finally {
-		await handle?.close().catch(() => {});
-	}
-}
 async function writeCredsJsonAtomically(authDir, creds) {
-	const credsPath = resolveWebCredsPath(authDir);
-	const tempPath = path.join(authDir, `.creds.${process.pid}.${randomUUID()}.tmp`);
-	const json = await stringifyCreds(creds);
-	let handle;
-	try {
-		handle = await fs$1.open(tempPath, "w", CREDS_FILE_MODE);
-		await handle.writeFile(json, { encoding: "utf-8" });
-		await handle.sync();
-		await handle.close();
-		handle = void 0;
-		await fs$1.rename(tempPath, credsPath);
-		await fs$1.chmod(credsPath, CREDS_FILE_MODE).catch(() => {});
-		await syncDirectory(path.dirname(credsPath));
-	} catch (error) {
-		await handle?.close().catch(() => {});
-		await fs$1.rm(tempPath, { force: true }).catch(() => {});
-		throw error;
-	}
+	await replaceFileAtomic({
+		filePath: resolveWebCredsPath(authDir),
+		content: await stringifyCreds(creds),
+		dirMode: 448,
+		mode: CREDS_FILE_MODE,
+		tempPrefix: ".creds",
+		syncTempFile: true,
+		syncParentDir: true
+	});
 }
 function enqueueCredsSave(authDir, saveCreds, onError) {
 	const next = (credsSaveQueues.get(authDir) ?? Promise.resolve()).then(() => saveCreds()).catch((error) => {
@@ -106,7 +88,6 @@ async function waitForWebAuthBarrier(authDir, context) {
 }
 async function restoreCredsFromBackupIfNeeded(authDir) {
 	const logger = getChildLogger({ module: "web-session" });
-	let tempRestorePath = null;
 	try {
 		const credsPath = resolveWebCredsPath(authDir);
 		const backupPath = resolveWebCredsBackupPath(authDir);
@@ -119,19 +100,16 @@ async function restoreCredsFromBackupIfNeeded(authDir) {
 		if (!backupRaw) return false;
 		if (!(await fs$1.lstat(backupPath).catch(() => null))?.isFile()) return false;
 		JSON.parse(backupRaw);
-		tempRestorePath = path.join(authDir, `.creds.restore-${randomUUID()}.tmp`);
-		await fs$1.writeFile(tempRestorePath, backupRaw, {
-			encoding: "utf-8",
+		await replaceFileAtomic({
+			filePath: credsPath,
+			content: backupRaw,
+			dirMode: 448,
 			mode: 384,
-			flag: "wx"
+			tempPrefix: ".creds.restore"
 		});
-		await fs$1.rename(tempRestorePath, credsPath);
-		tempRestorePath = null;
 		logger.warn({ credsPath }, "restored corrupted WhatsApp creds.json from backup");
 		return true;
-	} catch {} finally {
-		if (tempRestorePath) await fs$1.rm(tempRestorePath, { force: true }).catch(() => {});
-	}
+	} catch {}
 	return false;
 }
 async function webAuthExists(authDir = resolveDefaultWebAuthDir()) {

package/dist/{channel-CTr3YjO8.js → channel-BxntAClG.js}

@@ -4,16 +4,16 @@ import { c as normalizeWhatsAppTarget, i as looksLikeWhatsAppTargetId, n as isWh
 import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-CQ3Y1i0g.js";
 import { t as resolveWhatsAppReactionLevel } from "./reaction-level-CRVEVAfi.js";
 import "./normalize-Y3eBdM8a.js";
-import { r as normalizeWhatsAppPayloadTextPreservingIndentation } from "./outbound-media-contract-BPdOq7Hb.js";
-import { i as sendTypingWhatsApp, n as sendPollWhatsApp, t as sendMessageWhatsApp } from "./send-CxctcFGT.js";
-import { t as createWhatsAppLoginTool } from "./agent-tools-login-DpRxLNRB.js";
-import { t as createWhatsAppOutboundBase } from "./outbound-base-BmzhutvF.js";
-import { t as getWhatsAppRuntime } from "./runtime-6fZ67abR.js";
-import { t as whatsappCommandPolicy } from "./command-policy-O8sRnqUV.js";
-import { a as resolveWhatsAppGroupToolPolicy, c as formatWhatsAppConfigAllowFromEntries, i as resolveWhatsAppGroupRequireMention, n as loadWhatsAppChannelRuntime, o as resolveWhatsAppGroupIntroHint, r as whatsappSetupWizardProxy, s as resolveWhatsAppMentionStripRegexes, t as createWhatsAppPluginBase } from "./shared-CTSTwprn.js";
-import { d as readWebAuthExistsForDecision, n as WHATSAPP_AUTH_UNSTABLE_CODE } from "./auth-store-BNZmNP-s.js";
-import { t as whatsappSetupAdapter } from "./setup-core-DZKvpzbH.js";
-import { t as detectWhatsAppLegacyStateMigrations } from "./state-migrations-DnCdvoYD.js";
+import { r as normalizeWhatsAppPayloadTextPreservingIndentation } from "./outbound-media-contract-BzWwBppP.js";
+import { i as sendTypingWhatsApp, n as sendPollWhatsApp, t as sendMessageWhatsApp } from "./send-u88yh8Hw.js";
+import { t as createWhatsAppLoginTool } from "./agent-tools-login-DYKYW5Nh.js";
+import { t as createWhatsAppOutboundBase } from "./outbound-base-MVpg2zU2.js";
+import { t as getWhatsAppRuntime } from "./runtime-DdodQB8G.js";
+import { t as whatsappCommandPolicy } from "./command-policy-BgZRZ31o.js";
+import { a as resolveWhatsAppGroupToolPolicy, c as formatWhatsAppConfigAllowFromEntries, i as resolveWhatsAppGroupRequireMention, n as loadWhatsAppChannelRuntime, o as resolveWhatsAppGroupIntroHint, r as whatsappSetupWizardProxy, s as resolveWhatsAppMentionStripRegexes, t as createWhatsAppPluginBase } from "./shared-CgYT3IzU.js";
+import { d as readWebAuthExistsForDecision, n as WHATSAPP_AUTH_UNSTABLE_CODE } from "./auth-store-CjEimXKX.js";
+import { t as whatsappSetupAdapter } from "./setup-core-DnhO0PjG.js";
+import { t as detectWhatsAppLegacyStateMigrations } from "./state-migrations-CtdIArlK.js";
 import { createActionGate as createActionGate$1 } from "openclaw/plugin-sdk/channel-actions";
 import { formatCliCommand } from "openclaw/plugin-sdk/cli-runtime";
 import { buildChannelOutboundSessionRoute } from "openclaw/plugin-sdk/core";
@@ -23,6 +23,7 @@ import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { asString, collectIssuesForEnabledAccounts, createAsyncComputedAccountStatusAdapter, createDefaultChannelRuntimeState, isRecord } from "openclaw/plugin-sdk/status-helpers";
 import { createResolvedApproverActionAuthAdapter, resolveApprovalApprovers } from "openclaw/plugin-sdk/approval-auth-runtime";
+import { createMessageReceiptFromOutboundResults, defineChannelMessageAdapter } from "openclaw/plugin-sdk/channel-message";
 import { chunkText } from "openclaw/plugin-sdk/reply-chunking";
 //#region extensions/whatsapp/src/approval-auth.ts
 function normalizeWhatsAppApproverId(value) {
@@ -120,6 +121,31 @@ const whatsappChannelOutbound = {
 		text: normalizeWhatsAppChannelPayloadText(payload.text)
 	})
 };
+function toWhatsAppMessageSendResult(result, replyToId) {
+	const source = result;
+	const receipt = result.receipt ?? createMessageReceiptFromOutboundResults({
+		results: result.messageId ? [{
+			channel: "whatsapp",
+			messageId: result.messageId,
+			toJid: source.toJid
+		}] : [],
+		kind: "text",
+		...replyToId ? { replyToId } : {}
+	});
+	return {
+		messageId: result.messageId || receipt.primaryPlatformMessageId,
+		receipt
+	};
+}
+const whatsappMessageAdapter = defineChannelMessageAdapter({
+	id: "whatsapp",
+	durableFinal: { capabilities: {
+		text: true,
+		replyTo: true,
+		messageSendingHooks: true
+	} },
+	send: { text: async (ctx) => toWhatsAppMessageSendResult(await whatsappChannelOutbound.sendText({ ...ctx }), ctx.replyToId) }
+});
 //#endregion
 //#region extensions/whatsapp/src/heartbeat.ts
 async function checkWhatsAppHeartbeatReady(params) {
@@ -296,8 +322,8 @@ function collectWhatsAppStatusIssues(accounts) {
 }
 //#endregion
 //#region extensions/whatsapp/src/channel.ts
-const loadWhatsAppDirectoryConfig = createLazyRuntimeModule(() => import("./directory-config-BNCbgnmy.js").then((n) => n.t));
-const loadWhatsAppChannelReactAction = createLazyRuntimeModule(() => import("./channel-react-action-BuSTzmDX.js"));
+const loadWhatsAppDirectoryConfig = createLazyRuntimeModule(() => import("./directory-config-o-muXLgk.js").then((n) => n.t));
+const loadWhatsAppChannelReactAction = createLazyRuntimeModule(() => import("./channel-react-action-DJvzhIPw.js"));
 function parseWhatsAppExplicitTarget(raw) {
 	const normalized = normalizeWhatsAppTarget(raw);
 	if (!normalized) return null;
@@ -365,6 +391,7 @@ const whatsappPlugin = createChatChannelPlugin({
 				hint: "<E.164|group JID|newsletter JID>"
 			}
 		},
+		message: whatsappMessageAdapter,
 		directory: {
 			self: async ({ cfg, accountId }) => {
 				const account = resolveWhatsAppAccount({

package/dist/channel-config-api.js

@@ -1,2 +1,2 @@
-import { t as WhatsAppChannelConfigSchema } from "./config-schema-Dmo66Ubb.js";
+import { t as WhatsAppChannelConfigSchema } from "./config-schema-cSC7M4YA.js";
 export { WhatsAppChannelConfigSchema };

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as whatsappPlugin } from "./channel-CTr3YjO8.js";
+import { t as whatsappPlugin } from "./channel-BxntAClG.js";
 export { whatsappPlugin };