@openclaw/whatsapp 2026.8.1-beta.2 → 2026.9.1-beta.1

package/dist/{action-runtime-B4e3XFOY.js → action-runtime-C075e6OP.js}

@@ -1,6 +1,6 @@
 import { a as resolveWhatsAppAccount } from "./accounts-BX2fZUyR.js";
 import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-1GqbT1uX.js";
-import { _ as resolveWhatsAppReactionLevel, r as sendReactionWhatsApp } from "./send-prK8F7Vj.js";
+import { r as sendReactionWhatsApp, v as resolveWhatsAppReactionLevel } from "./send-DLMUc2uZ.js";
 import { ToolAuthorizationError, createActionGate, jsonResult, readReactionParams, readStringParam } from "openclaw/plugin-sdk/channel-actions";
 //#region extensions/whatsapp/src/action-runtime-target-auth.ts
 function resolveAuthorizedWhatsAppOutboundTarget(params) {

package/dist/action-runtime-api.js

@@ -1,2 +1,2 @@
-import { t as handleWhatsAppAction } from "./action-runtime-B4e3XFOY.js";
+import { t as handleWhatsAppAction } from "./action-runtime-C075e6OP.js";
 export { handleWhatsAppAction };

package/dist/action-runtime.runtime.js

@@ -1,2 +1,2 @@
-import { t as handleWhatsAppAction } from "./action-runtime-B4e3XFOY.js";
+import { t as handleWhatsAppAction } from "./action-runtime-C075e6OP.js";
 export { handleWhatsAppAction };

package/dist/{call-tool-api.js → agent-tools-api.js}

@@ -1,17 +1,18 @@
 import { a as resolveWhatsAppAccount } from "./accounts-BX2fZUyR.js";
 import { r as getWhatsAppConnectionController } from "./connection-controller-runtime-context-DG0tuYuw.js";
 import { s as resolveJidToE164 } from "./targets-runtime-TMk0lGuy.js";
+import { n as registerWhatsAppLoginTool } from "./agent-tools-login-B-2qZPzc.js";
 import { createActionGate, stringEnum } from "openclaw/plugin-sdk/channel-actions";
 import path from "node:path";
 import { resolveOAuthDir } from "openclaw/plugin-sdk/state-paths";
 import { normalizeE164 } from "openclaw/plugin-sdk/account-resolution";
-import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { Type } from "typebox";
 import fs from "node:fs/promises";
+import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { mulawToPcm } from "openclaw/plugin-sdk/realtime-voice";
 import { detectBinary } from "openclaw/plugin-sdk/setup-tools";
 import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/temp-path";
 import { jsonResult as jsonResult$1 } from "openclaw/plugin-sdk/tool-results";
+import { Type } from "typebox";
 //#region extensions/whatsapp/src/agent-tools-call.ts
 const MEOWCALLER_COMMAND = "meowcaller";
 const SESSION_DATABASE = "wa-voip.db";
@@ -222,4 +223,10 @@ function registerWhatsAppCallTool(api) {
 	api.registerTool((context) => createWhatsAppCallTool(api, context), { name: "whatsapp_call" });
 }
 //#endregion
-export { registerWhatsAppCallTool };
+//#region extensions/whatsapp/agent-tools-api.ts
+function registerWhatsAppAgentTools(api) {
+	registerWhatsAppCallTool(api);
+	registerWhatsAppLoginTool(api);
+}
+//#endregion
+export { registerWhatsAppAgentTools };

package/dist/{agent-tools-login-BjRpD-JQ.js → agent-tools-login-B-2qZPzc.js}

@@ -8,7 +8,8 @@ const QR_DATA_URL_MAX_LENGTH = 16384;
 function readLoginStringPreservingWhitespace(value) {
 	return hasNonEmptyString(value) ? value : void 0;
 }
-function createWhatsAppLoginTool() {
+function createWhatsAppLoginTool(context) {
+	if (context.senderIsOwner !== true) return null;
 	return {
 		label: "WhatsApp Login",
 		name: "whatsapp_login",
@@ -23,7 +24,10 @@ function createWhatsAppLoginTool() {
 				pattern: "^data:image/png;base64,.+$"
 			}))
 		}),
-		execute: async (_toolCallId, args) => {
+		execute: async (_toolCallId, args, signal) => {
+			const beforeCredentialPersistence = async () => {
+				if (!signal || signal.aborted) throw new Error("WhatsApp login authority is no longer active.");
+			};
 			const renderQrReply = (params) => {
 				return {
 					content: [{
@@ -64,9 +68,11 @@ function createWhatsAppLoginTool() {
 					details: { connected: result.connected }
 				};
 			}
+			await beforeCredentialPersistence();
 			const result = await startWebLoginWithQr({
 				accountId,
 				timeoutMs,
+				beforeCredentialPersistence,
 				force: typeof args.force === "boolean" ? args.force : false
 			});
 			if (!result.qrDataUrl) return {
@@ -84,5 +90,8 @@ function createWhatsAppLoginTool() {
 		}
 	};
 }
+function registerWhatsAppLoginTool(api) {
+	api.registerTool((context) => createWhatsAppLoginTool(context), { name: "whatsapp_login" });
+}
 //#endregion
-export { createWhatsAppLoginTool as t };
+export { registerWhatsAppLoginTool as n, createWhatsAppLoginTool as t };

package/dist/api.js

@@ -4,15 +4,15 @@ import { a as normalizeWhatsAppAllowFromEntries, c as normalizeWhatsAppTarget, i
 import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-1GqbT1uX.js";
 import { c as toWhatsappJid, i as markdownToWhatsApp, l as toWhatsappJidWithLid, n as isSelfChatMode, r as jidToE164, s as resolveJidToE164, t as assertWebChannel } from "./targets-runtime-TMk0lGuy.js";
 import { n as resolveUserPath, t as normalizeE164 } from "./text-runtime-CaKLhowd.js";
-import { n as WHATSAPP_LEGACY_OUTBOUND_SEND_DEP_KEYS, t as whatsappPlugin } from "./channel-DJVQHz_V.js";
-import { a as resolveWhatsAppGroupRequireMention, o as resolveWhatsAppGroupToolPolicy } from "./shared-Dp9M3ZPX.js";
+import { n as WHATSAPP_LEGACY_OUTBOUND_SEND_DEP_KEYS, t as whatsappPlugin } from "./channel-C4FMOZTE.js";
+import { a as resolveWhatsAppGroupRequireMention, o as resolveWhatsAppGroupToolPolicy } from "./shared-BekHi69d.js";
 import { t as whatsappCommandPolicy } from "./command-policy-BIOSHySD.js";
-import { t as whatsappSetupPlugin } from "./channel.setup-Cmvd967u.js";
+import { t as whatsappSetupPlugin } from "./channel.setup-CGcBvnpP.js";
 import { t as DEFAULT_WEB_MEDIA_BYTES } from "./constants-HU41RHGI.js";
-import { a as waitForWaConnection, o as DEFAULT_WHATSAPP_SOCKET_TIMING, r as createWaSocket, s as createWhatsAppSocketOperationTimeoutAdapter } from "./socket-close-09FojDO2.js";
+import { a as waitForWaConnection, o as DEFAULT_WHATSAPP_SOCKET_TIMING, r as createWaSocket, s as createWhatsAppSocketOperationTimeoutAdapter } from "./socket-close-2T0_jZTN.js";
 import { n as getStatusCode, t as formatError } from "./session-errors-JuazczrA.js";
-import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-Pc4f07wB.js";
-import { c as extractContextInfo, g as resolveInboundMediaMimetype, m as findMessageSection, o as describeReplyContext, p as extractText, t as createWebSendApi, u as extractLocationData } from "./send-api-DimZST3E.js";
+import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-P7_3U73Z.js";
+import { _ as resolveInboundMediaMimetype, c as extractContextInfo, m as findMessageSection, o as describeReplyContext, p as extractText, t as createWebSendApi, u as extractLocationData } from "./send-api-BtK45TmZ.js";
 import { asBoolean, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { formatLocationText } from "openclaw/plugin-sdk/channel-inbound";
 //#region extensions/whatsapp/src/qa-driver.runtime.ts

package/dist/{approval-handler.runtime-fgGZhALv.js → approval-handler.runtime-CljxfPJz.js}

@@ -1,10 +1,10 @@
 import "./accounts-BX2fZUyR.js";
 import { r as resolveDefaultWhatsAppAccountId } from "./account-ids-CB5SOWjc.js";
 import { s as normalizeWhatsAppMessagingTarget } from "./normalize-target-CugRyONv.js";
-import { i as sendTypingWhatsApp, t as sendMessageWhatsApp } from "./send-prK8F7Vj.js";
+import { i as sendTypingWhatsApp, t as sendMessageWhatsApp } from "./send-DLMUc2uZ.js";
 import { i as getWhatsAppRuntime } from "./runtime-BLlToOi6.js";
 import "./normalize-C7Hkc_vE.js";
-import { i as unregisterWhatsAppApprovalReactionTarget, r as registerWhatsAppApprovalReactionTarget } from "./approval-reactions-CmtJCxe_.js";
+import { i as unregisterWhatsAppApprovalReactionTarget, r as registerWhatsAppApprovalReactionTarget } from "./approval-reactions-Jyr1JaAK.js";
 import { createSubsystemLogger } from "openclaw/plugin-sdk/runtime-env";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
 import { buildApprovalReactionPendingContent } from "openclaw/plugin-sdk/approval-reaction-runtime";

package/dist/{approval-reactions-CmtJCxe_.js → approval-reactions-Jyr1JaAK.js}

@@ -4,7 +4,7 @@ import { n as getOptionalWhatsAppRuntime } from "./runtime-BLlToOi6.js";
 import { c as getWhatsAppApprovalApprovers, l as whatsappApprovalAuth } from "./group-session-key-DmFc_Cqi.js";
 import { isApprovalNotFoundError } from "openclaw/plugin-sdk/error-runtime";
 import { createLazyRuntimeSurface } from "openclaw/plugin-sdk/lazy-runtime";
-import { approvalReactionDecisionSetsMatch, createApprovalReactionTargetStore, listApprovalReactionBindings, readApprovalReactionDecisionList, readApprovalReactionDeliveredBinding, readApprovalReactionPresentationBinding, resolveTypedApprovalReactionTarget } from "openclaw/plugin-sdk/approval-reaction-runtime";
+import { approvalReactionDecisionSetsMatch, buildApprovalReactionDeliveredBindingMarker, createApprovalReactionTargetStore, listApprovalReactionBindings, readApprovalReactionDecisionList, readApprovalReactionDeliveredBinding, readApprovalReactionPresentationBinding, resolveTypedApprovalReactionTarget } from "openclaw/plugin-sdk/approval-reaction-runtime";
 import { createPluginStateErrorReporter } from "openclaw/plugin-sdk/plugin-state-runtime";
 //#region extensions/whatsapp/src/approval-reactions.ts
 var approval_reactions_exports = /* @__PURE__ */ __exportAll({
@@ -53,16 +53,15 @@ function reportApprovalBindingCorrelationMismatch(binding) {
 }
 function readPersistedTarget(target) {
 	const value = target;
-	if (!value || typeof value.approvalId !== "string" || !Array.isArray(value.allowedDecisions) || value.approvalKind !== "exec" && value.approvalKind !== "plugin") return null;
+	if (!value || typeof value.approvalId !== "string" || value.approvalKind !== "exec" && value.approvalKind !== "plugin") return null;
+	const allowedDecisions = readApprovalReactionDecisionList(value.allowedDecisions);
+	if (!allowedDecisions) return null;
 	return {
 		approvalId: value.approvalId,
 		approvalKind: value.approvalKind,
-		allowedDecisions: value.allowedDecisions
+		allowedDecisions
 	};
 }
-function listWhatsAppApprovalReactionBindings(allowedDecisions) {
-	return listApprovalReactionBindings({ allowedDecisions });
-}
 const APPROVAL_ID_LINE_RE = /^\s*ID:\s*(\S(?:.*\S)?)\s*$/i;
 const APPROVAL_KIND_LINE_RE = /^\s*(?:\S+\s+)?(Exec|Plugin) approval required\s*$/i;
 function visibleApprovalBindingMatches(text, binding) {
@@ -84,11 +83,11 @@ function visibleApprovalBindingMatches(text, binding) {
 		decisionLines.push(decisionLine);
 		cursor += 1;
 	}
-	const knownBindings = listWhatsAppApprovalReactionBindings([
+	const knownBindings = listApprovalReactionBindings({ allowedDecisions: [
 		"allow-once",
 		"allow-always",
 		"deny"
-	]);
+	] });
 	const decisions = readApprovalReactionDecisionList(decisionLines.map((line) => knownBindings.find((entry) => `${entry.emoji} ${entry.label}` === line)?.decision));
 	if (!decisions) return false;
 	return approvalReactionDecisionSetsMatch(binding.allowedDecisions, decisions);
@@ -105,17 +104,14 @@ function prepareWhatsAppApprovalPayloadForDelivery(params) {
 		...params.payload,
 		channelData: {
 			...params.payload.channelData,
-			[DELIVERY_BINDING_CHANNEL_DATA_KEY]: {
-				version: 1,
-				...binding
-			}
+			[DELIVERY_BINDING_CHANNEL_DATA_KEY]: buildApprovalReactionDeliveredBindingMarker(binding)
 		}
 	};
 }
 function registerWhatsAppApprovalReactionTarget(params) {
 	const key = buildReactionTargetKey(params);
 	const approvalId = params.approvalId.trim();
-	const allowedDecisions = listWhatsAppApprovalReactionBindings(params.allowedDecisions).map((binding) => binding.decision);
+	const allowedDecisions = listApprovalReactionBindings({ allowedDecisions: params.allowedDecisions }).map((binding) => binding.decision);
 	if (!key || !approvalId || params.approvalKind !== "exec" && params.approvalKind !== "plugin" || allowedDecisions.length === 0) return null;
 	const target = {
 		approvalId,

package/dist/{auth-store-B_DQIdzp.js → auth-store-CtpBqH5S.js}

@@ -8,6 +8,7 @@ import { replaceFileAtomic } from "openclaw/plugin-sdk/security-runtime";
 import { formatCliCommand } from "openclaw/plugin-sdk/cli-runtime";
 import { defaultRuntime, getChildLogger, info, success } from "openclaw/plugin-sdk/runtime-env";
 import fs from "node:fs/promises";
+import { isPathStrictlyInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/routing";
 import { enqueueKeyedTask } from "openclaw/plugin-sdk/keyed-async-queue";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
@@ -333,10 +334,6 @@ async function shouldClearOnLogout(authDir, isLegacyAuthDir) {
 		return (typeof codeValue === "string" ? codeValue : "") !== "ENOENT";
 	}
 }
-function isPathInsideDirectory(baseDir, targetPath) {
-	const relativePath = path.relative(baseDir, targetPath);
-	return relativePath !== "" && !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
-}
 async function pathHasSymlinkComponent(baseDir, targetPath) {
 	const relativePath = path.relative(baseDir, targetPath);
 	let currentPath = baseDir;
@@ -357,10 +354,10 @@ async function isLegacyWebAuthDir(authDir) {
 async function classifyWebAuthDirOwnership(authDir) {
 	const whatsappAuthBase = path.resolve(resolveOAuthDir$1(), "whatsapp");
 	const resolvedAuthDir = path.resolve(authDir);
-	if (!isPathInsideDirectory(whatsappAuthBase, resolvedAuthDir)) return { kind: "external" };
+	if (!isPathStrictlyInside(whatsappAuthBase, resolvedAuthDir)) return { kind: "external" };
 	const [baseRealPath, authDirRealPath] = await Promise.all([fs.realpath(whatsappAuthBase).catch(() => null), fs.realpath(resolvedAuthDir).catch(() => null)]);
 	if (!baseRealPath || !authDirRealPath) return { kind: "unsafe-owned" };
-	if (!isPathInsideDirectory(baseRealPath, authDirRealPath)) return { kind: "unsafe-owned" };
+	if (!isPathStrictlyInside(baseRealPath, authDirRealPath)) return { kind: "unsafe-owned" };
 	if (await pathHasSymlinkComponent(whatsappAuthBase, resolvedAuthDir)) return { kind: "unsafe-owned" };
 	return {
 		kind: "owned",

package/dist/{channel-DJVQHz_V.js → channel-C4FMOZTE.js}

@@ -2,16 +2,15 @@ import { a as resolveWhatsAppAccount } from "./accounts-BX2fZUyR.js";
 import { r as resolveDefaultWhatsAppAccountId, t as listAccountIds } from "./account-ids-CB5SOWjc.js";
 import { c as normalizeWhatsAppTarget, i as looksLikeWhatsAppTargetId, n as isWhatsAppNewsletterJid, o as normalizeWhatsAppAllowFromEntry, s as normalizeWhatsAppMessagingTarget, t as isWhatsAppGroupJid } from "./normalize-target-CugRyONv.js";
 import { t as resolveWhatsAppOutboundTarget } from "./resolve-outbound-target-1GqbT1uX.js";
-import { _ as resolveWhatsAppReactionLevel, a as normalizeWhatsAppOutboundPayload, i as sendTypingWhatsApp, n as sendPollWhatsApp, o as normalizeWhatsAppPayloadText, s as normalizeWhatsAppPayloadTextPreservingIndentation, t as sendMessageWhatsApp } from "./send-prK8F7Vj.js";
+import { c as normalizeWhatsAppPayloadTextPreservingIndentation, i as sendTypingWhatsApp, n as sendPollWhatsApp, o as normalizeWhatsAppOutboundPayload, s as normalizeWhatsAppPayloadText, t as sendMessageWhatsApp, v as resolveWhatsAppReactionLevel } from "./send-DLMUc2uZ.js";
 import { i as getWhatsAppRuntime } from "./runtime-BLlToOi6.js";
 import "./normalize-C7Hkc_vE.js";
 import { c as toWhatsappJid } from "./targets-runtime-TMk0lGuy.js";
 import "./text-runtime-CaKLhowd.js";
-import { t as createWhatsAppLoginTool } from "./agent-tools-login-BjRpD-JQ.js";
 import { c as getWhatsAppApprovalApprovers, l as whatsappApprovalAuth, s as lookupInboundMessageMetaForTarget, t as resolveWhatsAppGroupSessionKey } from "./group-session-key-DmFc_Cqi.js";
-import { a as resolveWhatsAppGroupRequireMention, c as loadWhatsAppChannelRuntime, i as whatsappSetupContract, l as readWhatsAppAccountLinkState, n as whatsappSetupWizardProxy, o as resolveWhatsAppGroupToolPolicy, s as formatWhatsAppConfigAllowFromEntries, t as createWhatsAppPluginBase } from "./shared-Dp9M3ZPX.js";
+import { a as resolveWhatsAppGroupRequireMention, c as loadWhatsAppChannelRuntime, i as whatsappSetupContract, l as readWhatsAppAccountLinkState, n as whatsappSetupWizardProxy, o as resolveWhatsAppGroupToolPolicy, s as formatWhatsAppConfigAllowFromEntries, t as createWhatsAppPluginBase } from "./shared-BekHi69d.js";
 import { t as whatsappCommandPolicy } from "./command-policy-BIOSHySD.js";
-import { f as readWebAuthExistsForDecision, n as WHATSAPP_AUTH_UNSTABLE_CODE } from "./auth-store-B_DQIdzp.js";
+import { f as readWebAuthExistsForDecision, n as WHATSAPP_AUTH_UNSTABLE_CODE } from "./auth-store-CtpBqH5S.js";
 import { createActionGate as createActionGate$1 } from "openclaw/plugin-sdk/channel-actions";
 import { normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-core";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
@@ -22,9 +21,9 @@ import { chunkText } from "openclaw/plugin-sdk/reply-chunking";
 import { createMessageReceiptFromOutboundResults, defineChannelMessageAdapter, resolveOutboundSendDep } from "openclaw/plugin-sdk/channel-outbound";
 import { sendTextMediaPayload } from "openclaw/plugin-sdk/reply-payload";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1 } from "openclaw/plugin-sdk/account-id";
+import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { buildDmGroupAccountAllowlistAdapter } from "openclaw/plugin-sdk/allowlist-config-edit";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
-import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { createApproverRestrictedNativeApprovalCapabilityFromForwardingRoutes } from "openclaw/plugin-sdk/approval-delivery-runtime";
 import { createLazyChannelApprovalNativeRuntimeAdapter } from "openclaw/plugin-sdk/approval-handler-adapter-runtime";
 import { buildApprovalReactionPromptPayloadForRequest } from "openclaw/plugin-sdk/approval-reaction-runtime";
@@ -80,7 +79,7 @@ const whatsappApproval = createApproverRestrictedNativeApprovalCapabilityFromFor
 			approvalKind,
 			request
 		}),
-		load: async () => (await import("./approval-handler.runtime-fgGZhALv.js")).whatsappApprovalNativeRuntime
+		load: async () => (await import("./approval-handler.runtime-CljxfPJz.js")).whatsappApprovalNativeRuntime
 	})
 });
 function buildWhatsAppPendingPayload(params, approvalKind) {
@@ -260,7 +259,7 @@ function createWhatsAppOutboundBase({ chunker, sendMessageWhatsApp, sendPollWhat
 }
 //#endregion
 //#region extensions/whatsapp/src/channel-outbound.ts
-const loadWhatsAppApprovalReactionsModule = createLazyRuntimeModule(() => import("./approval-reactions-CmtJCxe_.js").then((n) => n.t));
+const loadWhatsAppApprovalReactionsModule = createLazyRuntimeModule(() => import("./approval-reactions-Jyr1JaAK.js").then((n) => n.t));
 const loadWhatsAppQuestionReactionsModule = createLazyRuntimeModule(() => import("./question-reactions-D3eAeB0i.js").then((n) => n.n));
 function normalizeWhatsAppChannelPayloadText(text) {
 	return normalizeWhatsAppPayloadTextPreservingIndentation(text);
@@ -525,8 +524,8 @@ function collectWhatsAppStatusIssues(accounts) {
 }
 //#endregion
 //#region extensions/whatsapp/src/channel.ts
-const loadWhatsAppDirectoryConfig = createLazyRuntimeModule(() => import("./directory-config-Pc4f07wB.js").then((n) => n.t));
-const loadWhatsAppChannelReactAction = createLazyRuntimeModule(() => import("./channel-react-action-d6OacTNj.js"));
+const loadWhatsAppDirectoryConfig = createLazyRuntimeModule(() => import("./directory-config-P7_3U73Z.js").then((n) => n.t));
+const loadWhatsAppChannelReactAction = createLazyRuntimeModule(() => import("./channel-react-action-Bhp2BYRr.js"));
 function resolveWhatsAppTargetInfo(raw) {
 	const normalized = normalizeWhatsAppTarget(raw);
 	if (!normalized) return null;
@@ -563,7 +562,6 @@ const whatsappPlugin = createChatChannelPlugin({
 			isConfigured: (account) => Boolean(account.authDir),
 			isLinked: async (account) => await readWhatsAppAccountLinkState(account.authDir)
 		}),
-		agentTools: () => [createWhatsAppLoginTool()],
 		allowlist: buildDmGroupAccountAllowlistAdapter({
 			channelId: "whatsapp",
 			resolveAccount: resolveWhatsAppAccount,

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as whatsappPlugin } from "./channel-DJVQHz_V.js";
+import { t as whatsappPlugin } from "./channel-C4FMOZTE.js";
 export { whatsappPlugin };

package/dist/{channel-react-action-d6OacTNj.js → channel-react-action-Bhp2BYRr.js}

@@ -1,7 +1,7 @@
 import { a as resolveWhatsAppAccount, s as resolveWhatsAppMediaMaxBytes } from "./accounts-BX2fZUyR.js";
 import { c as normalizeWhatsAppTarget, t as isWhatsAppGroupJid } from "./normalize-target-CugRyONv.js";
-import { r as resolveAuthorizedWhatsAppOutboundTarget, t as handleWhatsAppAction } from "./action-runtime-B4e3XFOY.js";
-import { t as sendMessageWhatsApp } from "./send-prK8F7Vj.js";
+import { r as resolveAuthorizedWhatsAppOutboundTarget, t as handleWhatsAppAction } from "./action-runtime-C075e6OP.js";
+import { a as sendWhatsAppUploadFile } from "./send-DLMUc2uZ.js";
 import "./normalize-C7Hkc_vE.js";
 import { jsonResult, readStringOrNumberParam, readStringParam as readStringParam$1, resolveReactionMessageId } from "openclaw/plugin-sdk/channel-actions";
 import { canonicalizeBase64, estimateBase64DecodedBytes } from "openclaw/plugin-sdk/media-runtime";
@@ -23,17 +23,14 @@ function readWhatsAppActionChatJid(params) {
 	if (params.toolContext?.currentChannelProvider !== WHATSAPP_CHANNEL || !params.toolContext.currentChannelId) return;
 	return normalizeWhatsAppTarget(params.toolContext.currentChannelId) ?? void 0;
 }
-function extractBase64Payload(encoded) {
-	return /^data:[^;]+;base64,(.*)$/is.exec(encoded.trim())?.[1] ?? encoded;
-}
 function decodeUploadFileMediaPayload(params) {
-	const payload = extractBase64Payload(params.encoded);
+	const dataUrl = /^data:([^;]+);base64,(.*)$/is.exec(params.encoded.trim());
+	const payload = dataUrl?.[2] ?? params.encoded;
 	if (params.maxBytes !== void 0) {
 		const estimatedBytes = estimateBase64DecodedBytes(payload);
 		if (estimatedBytes > params.maxBytes) throw new Error(`WhatsApp upload-file buffer exceeds configured media limit (${estimatedBytes} bytes > ${params.maxBytes} bytes).`);
 	}
-	const contentType = readStringParam$1(params.args, "contentType") ?? readStringParam$1(params.args, "mimeType");
-	const fileName = readStringParam$1(params.args, "filename") ?? readStringParam$1(params.args, "fileName");
+	const contentType = params.contentType ?? dataUrl?.[1];
 	const canonicalPayload = canonicalizeBase64(payload);
 	if (!canonicalPayload) throw new Error("WhatsApp upload-file buffer must be valid base64 or a base64 data URL.");
 	const buffer = Buffer.from(canonicalPayload, "base64");
@@ -41,12 +38,14 @@ function decodeUploadFileMediaPayload(params) {
 	return {
 		buffer,
 		...contentType ? { contentType } : {},
-		...fileName ? { fileName } : {}
+		...params.fileName ? { fileName: params.fileName } : {}
 	};
 }
 async function handleWhatsAppUploadFileAction(params) {
 	const mediaUrl = readUploadFileMediaSource(params.params);
 	const encodedPayload = readStringParam$1(params.params, "buffer", { trim: false });
+	const contentType = readStringParam$1(params.params, "contentType") ?? readStringParam$1(params.params, "mimeType");
+	const fileName = readStringParam$1(params.params, "filename") ?? readStringParam$1(params.params, "fileName");
 	if (!mediaUrl && !hasUploadFileBufferPayload(params.params)) throw new Error("WhatsApp upload-file requires media, mediaUrl, filePath, path, fileUrl, or buffer.");
 	const to = readWhatsAppActionChatJid(params) ?? readStringParam$1(params.params, "to", { required: true });
 	const resolved = resolveAuthorizedWhatsAppOutboundTarget({
@@ -60,15 +59,18 @@ async function handleWhatsAppUploadFileAction(params) {
 		accountId: resolved.accountId
 	});
 	const mediaPayload = encodedPayload ? decodeUploadFileMediaPayload({
-		args: params.params,
 		encoded: encodedPayload,
+		contentType,
+		fileName,
 		maxBytes: resolveWhatsAppMediaMaxBytes(account)
 	}) : void 0;
-	const result = await sendMessageWhatsApp(resolved.to, readUploadFileCaptionText(params.params), {
+	const result = await sendWhatsAppUploadFile(resolved.to, readUploadFileCaptionText(params.params), {
 		verbose: false,
 		cfg: params.cfg,
 		...mediaUrl && !mediaPayload ? { mediaUrl } : {},
 		...mediaPayload ? { mediaPayload } : {},
+		...mediaUrl && !mediaPayload && fileName ? { fileName } : {},
+		...mediaUrl && !mediaPayload && contentType ? { contentType } : {},
 		mediaAccess: params.mediaAccess,
 		mediaLocalRoots: params.mediaLocalRoots,
 		mediaReadFile: params.mediaReadFile,

package/dist/{channel.runtime-RxuNGZ7w.js → channel.runtime-CrahUvcb.js}

@@ -1,9 +1,9 @@
 import { startWebLoginWithQr as startWebLoginWithQr$1, waitForWebLogin as waitForWebLogin$1 } from "./login-qr-runtime.js";
-import { c as logoutWeb$1, d as readWebAuthExistsBestEffort$1, f as readWebAuthExistsForDecision$1, g as readWebSelfId$1, h as readWebAuthState$1, m as readWebAuthSnapshotBestEffort$1, o as getWebAuthAgeMs$1, p as readWebAuthSnapshot$1, s as logWebSelfId$1, x as webAuthExists$1 } from "./auth-store-B_DQIdzp.js";
+import { c as logoutWeb$1, d as readWebAuthExistsBestEffort$1, f as readWebAuthExistsForDecision$1, g as readWebSelfId$1, h as readWebAuthState$1, m as readWebAuthSnapshotBestEffort$1, o as getWebAuthAgeMs$1, p as readWebAuthSnapshot$1, s as logWebSelfId$1, x as webAuthExists$1 } from "./auth-store-CtpBqH5S.js";
 import { t as getActiveWebListener$1 } from "./active-listener-BEjWsCNM.js";
-import { t as monitorWebChannel$1 } from "./monitor-BCe5Mm-1.js";
-import { t as loginWeb$1 } from "./login-D6_rfxTZ.js";
-import { whatsappSetupWizard as whatsappSetupWizard$1 } from "./setup-surface-BCZszf3l.js";
+import { t as monitorWebChannel$1 } from "./monitor-C_Nw23PZ.js";
+import { t as loginWeb$1 } from "./login-BkpKpndm.js";
+import { whatsappSetupWizard as whatsappSetupWizard$1 } from "./setup-surface-CjjqIxQP.js";
 //#region extensions/whatsapp/src/channel.runtime.ts
 function getActiveWebListener(...args) {
 	return getActiveWebListener$1(...args);

package/dist/{channel.setup-Cmvd967u.js → channel.setup-CGcBvnpP.js}

@@ -1,4 +1,4 @@
-import { a as resolveWhatsAppGroupRequireMention, i as whatsappSetupContract, l as readWhatsAppAccountLinkState, n as whatsappSetupWizardProxy, o as resolveWhatsAppGroupToolPolicy, t as createWhatsAppPluginBase } from "./shared-Dp9M3ZPX.js";
+import { a as resolveWhatsAppGroupRequireMention, i as whatsappSetupContract, l as readWhatsAppAccountLinkState, n as whatsappSetupWizardProxy, o as resolveWhatsAppGroupToolPolicy, t as createWhatsAppPluginBase } from "./shared-BekHi69d.js";
 //#region extensions/whatsapp/src/channel.setup.ts
 const whatsappSetupPlugin = { ...createWhatsAppPluginBase({
 	groups: {

package/dist/{connection-controller-CUyZgGpf.js → connection-controller-CIYuBJrs.js}

@@ -1,7 +1,7 @@
 import { r as getWhatsAppChannelRuntime } from "./runtime-BLlToOi6.js";
 import { n as WHATSAPP_CONNECTION_OWNER_PENDING_CAPABILITY, t as WHATSAPP_CONNECTION_CONTROLLER_CAPABILITY } from "./connection-controller-runtime-context-DG0tuYuw.js";
-import { M as waitForCredsSaveQueueWithTimeout, c as logoutWeb, f as readWebAuthExistsForDecision, k as resolveComparableIdentity, r as WhatsAppAuthUnstableError } from "./auth-store-B_DQIdzp.js";
-import { a as waitForWaConnection, m as acquireWhatsAppGatewayConnectionOwner, o as DEFAULT_WHATSAPP_SOCKET_TIMING, r as createWaSocket, t as closeWhatsAppSocketAndWait } from "./socket-close-09FojDO2.js";
+import { M as waitForCredsSaveQueueWithTimeout, c as logoutWeb, f as readWebAuthExistsForDecision, k as resolveComparableIdentity, r as WhatsAppAuthUnstableError } from "./auth-store-CtpBqH5S.js";
+import { a as waitForWaConnection, m as acquireWhatsAppGatewayConnectionOwner, o as DEFAULT_WHATSAPP_SOCKET_TIMING, r as createWaSocket, t as closeWhatsAppSocketAndWait } from "./socket-close-2T0_jZTN.js";
 import { n as getStatusCode, t as formatError } from "./session-errors-JuazczrA.js";
 import { computeBackoff, info, sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
 import { registerChannelRuntimeContext } from "openclaw/plugin-sdk/channel-runtime-context";

package/dist/{directory-config-Pc4f07wB.js → directory-config-P7_3U73Z.js}

@@ -3,9 +3,9 @@ import { c as resolveMergedWhatsAppAccountConfig, o as resolveWhatsAppAuthDir }
 import { c as normalizeWhatsAppTarget, t as isWhatsAppGroupJid } from "./normalize-target-CugRyONv.js";
 import { i as hasPendingWhatsAppConnectionOwner, r as getWhatsAppConnectionController } from "./connection-controller-runtime-context-DG0tuYuw.js";
 import "./normalize-C7Hkc_vE.js";
-import { M as waitForCredsSaveQueueWithTimeout, f as readWebAuthExistsForDecision } from "./auth-store-B_DQIdzp.js";
+import { M as waitForCredsSaveQueueWithTimeout, f as readWebAuthExistsForDecision } from "./auth-store-CtpBqH5S.js";
 import { n as resolveWebAccountId } from "./active-listener-BEjWsCNM.js";
-import { a as waitForWaConnection, h as acquireWhatsAppStandaloneConnectionOwner, n as createWaDirectorySocket, p as WhatsAppConnectionOwnerBusyError, t as closeWhatsAppSocketAndWait } from "./socket-close-09FojDO2.js";
+import { a as waitForWaConnection, h as acquireWhatsAppStandaloneConnectionOwner, n as createWaDirectorySocket, p as WhatsAppConnectionOwnerBusyError, t as closeWhatsAppSocketAndWait } from "./socket-close-2T0_jZTN.js";
 import { listResolvedDirectoryGroupEntriesFromMapKeys, listResolvedDirectoryUserEntriesFromAllowFrom } from "openclaw/plugin-sdk/directory-config-runtime";
 //#region extensions/whatsapp/src/directory-config.ts
 var directory_config_exports = /* @__PURE__ */ __exportAll({

package/dist/directory-contract-api.js

@@ -1,4 +1,4 @@
-import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-Pc4f07wB.js";
+import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./directory-config-P7_3U73Z.js";
 //#region extensions/whatsapp/directory-contract-api.ts
 const whatsappDirectoryContractPlugin = {
 	id: "whatsapp",

package/dist/index.js

@@ -1,9 +1,9 @@
 import { defineBundledChannelEntry, loadBundledEntryExportSync } from "openclaw/plugin-sdk/channel-entry-contract";
 //#region extensions/whatsapp/index.ts
-function registerWhatsAppCallTool(api) {
+function registerWhatsAppAgentTools(api) {
 	loadBundledEntryExportSync(import.meta.url, {
-		specifier: "./call-tool-api.js",
-		exportName: "registerWhatsAppCallTool"
+		specifier: "./agent-tools-api.js",
+		exportName: "registerWhatsAppAgentTools"
 	})(api);
 }
 var whatsapp_default = defineBundledChannelEntry({
@@ -19,7 +19,7 @@ var whatsapp_default = defineBundledChannelEntry({
 		specifier: "./runtime-setter-api.js",
 		exportName: "setWhatsAppRuntime"
 	},
-	registerFull: registerWhatsAppCallTool
+	registerFull: registerWhatsAppAgentTools
 });
 //#endregion
 export { whatsapp_default as default };

package/dist/light-runtime-api.js

@@ -1,5 +1,5 @@
-import { t as createWhatsAppLoginTool } from "./agent-tools-login-BjRpD-JQ.js";
-import { c as logoutWeb, g as readWebSelfId, l as pickWebChannel, o as getWebAuthAgeMs, s as logWebSelfId, t as WA_WEB_AUTH_DIR, x as webAuthExists, y as resolveDefaultWebAuthDir } from "./auth-store-B_DQIdzp.js";
+import { t as createWhatsAppLoginTool } from "./agent-tools-login-B-2qZPzc.js";
+import { c as logoutWeb, g as readWebSelfId, l as pickWebChannel, o as getWebAuthAgeMs, s as logWebSelfId, t as WA_WEB_AUTH_DIR, x as webAuthExists, y as resolveDefaultWebAuthDir } from "./auth-store-CtpBqH5S.js";
 import { t as getActiveWebListener } from "./active-listener-BEjWsCNM.js";
 import { n as getStatusCode, t as formatError } from "./session-errors-JuazczrA.js";
 export { WA_WEB_AUTH_DIR, createWhatsAppLoginTool, formatError, getActiveWebListener, getStatusCode, getWebAuthAgeMs, logWebSelfId, logoutWeb, pickWebChannel, readWebSelfId, resolveDefaultWebAuthDir, webAuthExists };

package/dist/{login-D6_rfxTZ.js → login-BkpKpndm.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { a as resolveWhatsAppAccount } from "./accounts-BX2fZUyR.js";
-import { b as restoreCredsFromBackupIfNeeded } from "./auth-store-B_DQIdzp.js";
-import { f as renderQrTerminal, r as createWaSocket, u as resolveWhatsAppSocketTiming } from "./socket-close-09FojDO2.js";
-import { a as closeWaSocketSoon, o as waitForWhatsAppLoginResult } from "./connection-controller-CUyZgGpf.js";
+import { b as restoreCredsFromBackupIfNeeded } from "./auth-store-CtpBqH5S.js";
+import { f as renderQrTerminal, r as createWaSocket, u as resolveWhatsAppSocketTiming } from "./socket-close-2T0_jZTN.js";
+import { a as closeWaSocketSoon, o as waitForWhatsAppLoginResult } from "./connection-controller-CIYuBJrs.js";
 import { formatCliCommand } from "openclaw/plugin-sdk/cli-runtime";
 import { logInfo } from "openclaw/plugin-sdk/logging-core";
 import { danger, defaultRuntime, success } from "openclaw/plugin-sdk/runtime-env";

package/dist/{login-qr-B0VyVSqQ.js → login-qr-DY4VFgOq.js}

@@ -1,9 +1,9 @@
 import { a as resolveWhatsAppAccount } from "./accounts-BX2fZUyR.js";
-import { c as logoutWeb, f as readWebAuthExistsForDecision, g as readWebSelfId, n as WHATSAPP_AUTH_UNSTABLE_CODE } from "./auth-store-B_DQIdzp.js";
+import { c as logoutWeb, f as readWebAuthExistsForDecision, g as readWebSelfId, n as WHATSAPP_AUTH_UNSTABLE_CODE } from "./auth-store-CtpBqH5S.js";
 import { t as getActiveWebListener } from "./active-listener-BEjWsCNM.js";
-import { r as createWaSocket, u as resolveWhatsAppSocketTiming } from "./socket-close-09FojDO2.js";
+import { r as createWaSocket, u as resolveWhatsAppSocketTiming } from "./socket-close-2T0_jZTN.js";
 import { t as formatError } from "./session-errors-JuazczrA.js";
-import { i as closeWaSocket, o as waitForWhatsAppLoginResult, t as WHATSAPP_LOGGED_OUT_QR_MESSAGE } from "./connection-controller-CUyZgGpf.js";
+import { i as closeWaSocket, o as waitForWhatsAppLoginResult, t as WHATSAPP_LOGGED_OUT_QR_MESSAGE } from "./connection-controller-CIYuBJrs.js";
 import { logInfo } from "openclaw/plugin-sdk/logging-core";
 import { danger, defaultRuntime, info, success } from "openclaw/plugin-sdk/runtime-env";
 import { renderQrPngDataUrl } from "openclaw/plugin-sdk/media-runtime";
@@ -28,8 +28,8 @@ function closeSocket(sock) {
 async function resetActiveLogin(accountId, reason) {
 	const login = activeLogins.get(accountId);
 	if (login) {
-		closeSocket(login.sock);
 		activeLogins.delete(accountId);
+		closeSocket(login.sock);
 	}
 	if (reason) logInfo(reason);
 }
@@ -94,6 +94,7 @@ function attachLoginWaiter(accountId, login) {
 		verbose: login.verbose,
 		runtime: login.runtime,
 		socketTiming: login.socketTiming,
+		beforeCredentialPersistence: login.beforeCredentialPersistence,
 		onQr: (qr) => {
 			const current = activeLogins.get(accountId);
 			if (!current || current.id !== login.id) return;
@@ -203,7 +204,8 @@ async function startWebLoginWithQr(opts = {}) {
 		if (!await logoutWeb({
 			authDir: account.authDir,
 			isLegacyAuthDir: account.isLegacyAuthDir,
-			runtime
+			runtime,
+			beforeCredentialPersistence: opts.beforeCredentialPersistence
 		})) return { message: "WhatsApp login failed: existing auth could not be cleared. Remove or fix the configured WhatsApp auth directory, then retry login." };
 	} catch (err) {
 		return { message: `WhatsApp login failed: ${formatError(err)}` };
@@ -226,10 +228,20 @@ async function startWebLoginWithQr(opts = {}) {
 	let sock;
 	let pendingQr = null;
 	const loginId = randomUUID();
+	const operationOwner = {};
+	const beforeCredentialPersistence = async () => {
+		const login = operationOwner.current;
+		if (!login) {
+			await opts.beforeCredentialPersistence?.();
+			return;
+		}
+		if (activeLogins.get(account.accountId) !== login || !isLoginFresh(login)) throw new Error("WhatsApp login is no longer active.");
+	};
 	try {
 		sock = await createWaSocket(false, Boolean(opts.verbose), {
 			authDir: account.authDir,
 			...socketTiming,
+			beforeCredentialPersistence,
 			onQr: (qr) => {
 				pendingQr = qr;
 				const current = activeLogins.get(account.accountId);
@@ -256,7 +268,7 @@ async function startWebLoginWithQr(opts = {}) {
 		await resetActiveLogin(account.accountId);
 		return { message: `Failed to start WhatsApp login: ${String(err)}` };
 	}
-	const login = {
+	const nextLogin = {
 		accountId: account.accountId,
 		authDir: account.authDir,
 		isLegacyAuthDir: account.isLegacyAuthDir,
@@ -271,23 +283,32 @@ async function startWebLoginWithQr(opts = {}) {
 		qrRenderPromise: null,
 		verbose: Boolean(opts.verbose),
 		runtime,
-		socketTiming
+		socketTiming,
+		beforeCredentialPersistence
 	};
-	resetQrUpdateSignal(login);
-	activeLogins.set(account.accountId, login);
+	try {
+		await opts.beforeCredentialPersistence?.();
+	} catch (err) {
+		clearTimeout(qrTimer);
+		closeSocket(sock);
+		return { message: `Failed to start WhatsApp login: ${String(err)}` };
+	}
+	operationOwner.current = nextLogin;
+	resetQrUpdateSignal(nextLogin);
+	activeLogins.set(account.accountId, nextLogin);
 	if (pendingQr) {
-		const qrVersion = updateLoginQrState(login, pendingQr);
+		const qrVersion = updateLoginQrState(nextLogin, pendingQr);
 		renderLatestQrDataUrlInBackground({
 			accountId: account.accountId,
-			loginId: login.id,
+			loginId: nextLogin.id,
 			qr: pendingQr,
 			qrVersion
 		});
 	}
-	attachLoginWaiter(account.accountId, login);
+	attachLoginWaiter(account.accountId, nextLogin);
 	const loginStartResult = await waitForQrOrRecoveredLogin({
 		accountId: account.accountId,
-		login,
+		login: nextLogin,
 		qrPromise
 	});
 	clearTimeout(qrTimer);
@@ -304,8 +325,8 @@ async function startWebLoginWithQr(opts = {}) {
 		await resetActiveLogin(account.accountId);
 		return { message: loginStartResult.message };
 	}
-	const qr = login.qr ?? loginStartResult.qr;
-	const qrVersion = login.qrVersion;
+	const qr = nextLogin.qr ?? loginStartResult.qr;
+	const qrVersion = nextLogin.qrVersion;
 	if (qrVersion === 0) {
 		await resetActiveLogin(account.accountId);
 		return { message: "Failed to capture the active WhatsApp QR. Ask me to generate a new one." };
@@ -314,7 +335,7 @@ async function startWebLoginWithQr(opts = {}) {
 	try {
 		qrDataUrl = await ensureQrDataUrl({
 			accountId: account.accountId,
-			loginId: login.id,
+			loginId: nextLogin.id,
 			qr,
 			qrVersion
 		});

package/dist/login-qr-runtime.js

@@ -1,6 +1,6 @@
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 //#region extensions/whatsapp/login-qr-runtime.ts
-const loadLoginQrModule = createLazyRuntimeModule(() => import("./login-qr-B0VyVSqQ.js"));
+const loadLoginQrModule = createLazyRuntimeModule(() => import("./login-qr-DY4VFgOq.js"));
 async function startWebLoginWithQr(...args) {
 	const { startWebLoginWithQr: startWebLoginWithQrLocal } = await loadLoginQrModule();
 	return await startWebLoginWithQrLocal(...args);