@xmanrui/dsh-im 3.0.1 → 3.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmanrui/dsh-im",
-  "version": "3.0.1",
+  "version": "3.0.3",
   "description": "把九种 IM 机器人和公网 AI Office 接入本机 DeepSeek Harness。 Connect nine IM channels and a public AI Office to a local DeepSeek Harness.",
   "keywords": [
     "deepseek-harness",

package/plugin-src/client/channels/whatsapp/api.js

@@ -97,6 +97,11 @@ function normalizeBot(value) {
             typeof entry === 'string' && /^[1-9]\d{4,14}$/.test(entry)
           )))]
         : [],
+      groupAllowedNumbers: Array.isArray(value.accessPolicy?.groupAllowedNumbers)
+        ? [...new Set(value.accessPolicy.groupAllowedNumbers.filter((entry) => (
+            typeof entry === 'string' && /^[1-9]\d{4,14}$/.test(entry)
+          )))]
+        : [],
     },
     bot: {
       name: text(value.bot?.name, 'WhatsApp机器人', 100),

package/plugin-src/client/channels/whatsapp/index.js

@@ -37,6 +37,8 @@ function accessPolicyFor(account) {
     accessMode,
     allowedNumbers: Array.isArray(account?.accessPolicy?.allowedNumbers)
       ? account.accessPolicy.allowedNumbers : [],
+    groupAllowedNumbers: Array.isArray(account?.accessPolicy?.groupAllowedNumbers)
+      ? account.accessPolicy.groupAllowedNumbers : [],
   };
 }
 
@@ -52,30 +54,39 @@ function allowedNumbersFromText(value) {
 export function WhatsappAccessSettings({ account, busy = false, onSave }) {
   const policy = accessPolicyFor(account);
   const sourceNumbers = policy.allowedNumbers.join('\n');
+  const sourceGroupNumbers = policy.groupAllowedNumbers.join('\n');
   const helpId = React.useId();
   const [accessMode, setAccessMode] = React.useState(policy.accessMode);
   const [allowedNumbers, setAllowedNumbers] = React.useState(sourceNumbers);
+  const [groupAllowedNumbers, setGroupAllowedNumbers] = React.useState(sourceGroupNumbers);
   const [error, setError] = React.useState(null);
 
   React.useEffect(() => {
     setAccessMode(policy.accessMode);
     setAllowedNumbers(sourceNumbers);
+    setGroupAllowedNumbers(sourceGroupNumbers);
     setError(null);
-  }, [policy.accessMode, sourceNumbers]);
+  }, [policy.accessMode, sourceNumbers, sourceGroupNumbers]);
 
   const save = async (event) => {
     event.preventDefault();
     setError(null);
     try {
       const normalized = allowedNumbersFromText(allowedNumbers);
+      const normalizedGroup = allowedNumbersFromText(groupAllowedNumbers);
       if (typeof onSave !== 'function') throw new Error('WhatsApp 访问设置暂不可用。');
-      await onSave({ accessMode, allowedNumbers: normalized });
+      await onSave({
+        accessMode,
+        allowedNumbers: normalized,
+        groupAllowedNumbers: normalizedGroup,
+      });
     } catch (caught) {
       setError(caught?.message ?? 'WhatsApp 访问设置保存失败。');
     }
   };
 
   const allowlistEnabled = accessMode === 'private-allowlist';
+  const groupAllowlistEnabled = accessMode === 'open';
   const labels = {
     'self-only': '仅自己模式',
     'private-allowlist': '指定联系人模式',
@@ -103,7 +114,7 @@ export function WhatsappAccessSettings({ account, busy = false, onSave }) {
               h('span', null, '响应自聊和白名单联系人的私聊，忽略群聊。')),
             h('span', { className: 'dwa-accessTooltipItem' },
               h('strong', null, '开放响应模式'),
-              h('span', null, '响应所有私聊、已绑定账号自己发出的群聊消息，以及其他群成员的提及或回复。')))))),
+              h('span', null, '响应所有私聊、已绑定账号自己发出的群聊消息，以及允许成员的提及或回复；群聊号码列表留空时允许所有群成员。')))))),
     h('label', { className: 'dwa-accessField' },
       h('span', null, '模式'),
       h('select', {
@@ -115,18 +126,28 @@ export function WhatsappAccessSettings({ account, busy = false, onSave }) {
       h('option', { value: 'self-only' }, '仅自己模式（默认）'),
       h('option', { value: 'private-allowlist' }, '指定联系人模式'),
       h('option', { value: 'open' }, '开放响应模式'))),
-    allowlistEnabled
+    (allowlistEnabled || groupAllowlistEnabled)
       ? h('label', { className: 'dwa-accessField' },
-          h('span', null, '允许私聊的 WhatsApp 电话号码'),
+          h('span', null, allowlistEnabled
+            ? '允许私聊的 WhatsApp 电话号码'
+            : '允许在群聊中呼叫机器人的 WhatsApp 电话号码'),
           h('textarea', {
-            value: allowedNumbers,
+            value: allowlistEnabled ? allowedNumbers : groupAllowedNumbers,
             disabled: busy,
             rows: 3,
             placeholder: '每行一个含国家或地区代码的号码',
-            'aria-label': '允许私聊的 WhatsApp 电话号码',
-            onChange: (event) => { setAllowedNumbers(event.target.value); setError(null); },
+            'aria-label': allowlistEnabled
+              ? '允许私聊的 WhatsApp 电话号码'
+              : '允许在群聊中呼叫机器人的 WhatsApp 电话号码',
+            onChange: (event) => {
+              if (allowlistEnabled) setAllowedNumbers(event.target.value);
+              else setGroupAllowedNumbers(event.target.value);
+              setError(null);
+            },
           }),
-          h('small', null, '可以包含开头的 +，保存时会自动移除。'))
+          h('small', null, allowlistEnabled
+            ? '可以包含开头的 +，保存时会自动移除。'
+            : '留空表示所有群成员都可以通过提及或回复呼叫机器人。'))
       : null,
     allowlistEnabled && allowedNumbers.trim() === ''
       ? h('p', { className: 'dwa-accessWarning', role: 'status' },

package/plugin-src/client/i18n.js

@@ -380,9 +380,12 @@ const EN = Object.freeze({
   '只响应已绑定 WhatsApp 账号的自聊消息。': 'Only respond to self-chat messages from the linked WhatsApp account.',
   '响应自聊和白名单联系人的私聊，忽略群聊。': 'Respond to self-chat and allowlisted direct messages; ignore group messages.',
   '响应所有私聊、已绑定账号自己发出的群聊消息，以及其他群成员的提及或回复。': 'Respond to all direct messages, group messages sent by the linked account, and mentions or replies from other group members.',
+  '响应所有私聊、已绑定账号自己发出的群聊消息，以及允许成员的提及或回复；群聊号码列表留空时允许所有群成员。': 'Respond to all direct messages, group messages sent by the linked account, and mentions or replies from allowed members; leaving the group number list empty allows every group member.',
   '允许私聊的 WhatsApp 电话号码': 'WhatsApp phone numbers allowed to send direct messages',
+  '允许在群聊中呼叫机器人的 WhatsApp 电话号码': 'WhatsApp phone numbers allowed to call the bot in group chats',
   '每行一个含国家或地区代码的号码': 'One number with country or region code per line',
   '可以包含开头的 +，保存时会自动移除。': 'A leading + is allowed and removed when saved.',
+  '留空表示所有群成员都可以通过提及或回复呼叫机器人。': 'Leave empty to let every group member call the bot by mentioning it or replying to it.',
   '仅指定联系人模式使用白名单，切换模式时会保留。': 'Only Selected contacts uses the allowlist; it is retained when modes change.',
   '白名单为空；保存后将只接受自聊消息。': 'The allowlist is empty; only self-chat messages will be accepted after saving.',
   '电话号码必须包含国家或地区代码，每行一个。': 'Each phone number must include a country or region code on its own line.',

package/plugin-src/client/index.js

@@ -161,7 +161,6 @@ export function IMSettingsTab({
 }) {
   const [selected, setSelected] = React.useState('weixin');
   const [loopbackRecovery, setLoopbackRecovery] = React.useState(null);
-  const versionTooltipId = React.useId();
   const githubTooltipId = React.useId();
   const active = CHANNELS.find((channel) => channel.id === selected) ?? CHANNELS[0];
   const reportLoopbackRecovery = React.useCallback((recovery) => {
@@ -198,20 +197,11 @@ export function IMSettingsTab({
   return h(WorkspaceDirectoryPickerContext.Provider, { value: workspaceDirectoryPicker },
     h('section', { className: 'dim-page', 'aria-label': 'IM机器人设置' },
     h('header', { className: 'dim-title' },
-      h('div', {
-        className: 'dim-brand',
-        tabIndex: 0,
-        'aria-describedby': versionTooltipId,
-      },
-        h('strong', { className: 'dim-brandName' }, 'DSH-IM'),
-        h('p', null, '让 DeepSeek Harness 触手可及'),
-        h('span', {
-          id: versionTooltipId,
-          className: 'dim-versionTooltip',
-          role: 'tooltip',
-        },
-        h('span', null, '当前版本'),
-        h('strong', null, `v${IM_PLUGIN_VERSION}`))),
+      h('div', { className: 'dim-brand' },
+        h('div', { className: 'dim-brandHeading' },
+          h('strong', { className: 'dim-brandName' }, 'DSH-IM'),
+          h('span', { className: 'dim-brandVersion' }, `v${IM_PLUGIN_VERSION}`)),
+        h('p', null, '让 DeepSeek Harness 触手可及')),
       h('span', { className: 'dim-githubAction' },
         h('a', {
           className: 'dim-githubLink',

package/plugin-src/client/styles.js

@@ -12,13 +12,11 @@ const CSS = String.raw`
 }
 .dim-page *, .dim-page *::before, .dim-page *::after { box-sizing: border-box; }
 .dim-title { display: flex; align-items: center; justify-content: space-between; gap: 16px; margin: 0 0 18px; }
-.dim-brand { position: relative; min-width: 0; width: max-content; max-width: 100%; display: flex; flex-direction: column; align-items: flex-start; gap: 1px; margin: -2px -6px; padding: 2px 6px; border-radius: 8px; cursor: help; }
-.dim-brand:focus-visible { outline: 2px solid color-mix(in srgb, var(--dim-blue) 70%, white); outline-offset: 2px; }
+.dim-brand { min-width: 0; width: max-content; max-width: 100%; display: flex; flex-direction: column; align-items: flex-start; gap: 1px; margin: -2px -6px; padding: 2px 6px; border-radius: 8px; }
+.dim-brandHeading { display: flex; align-items: baseline; gap: 8px; white-space: nowrap; }
 .dim-brandName { color: var(--dsw-alias-label-primary, #1f2329); font-size: 20px; line-height: 24px; font-weight: 800; letter-spacing: .04em; }
+.dim-brandVersion { color: var(--dsw-alias-label-tertiary, #8f959e); font: 500 10px/16px ui-monospace, SFMono-Regular, Menlo, monospace; letter-spacing: 0; }
 .dim-title p { margin: 0; color: var(--dsw-alias-label-secondary, #646a73); font-size: 12px; line-height: 18px; font-weight: 500; white-space: nowrap; }
-.dim-versionTooltip { position: absolute; top: calc(100% + 8px); left: 0; z-index: 20; width: max-content; max-width: min(220px, 80vw); display: inline-flex; align-items: center; gap: 6px; padding: 6px 9px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 7px; color: var(--dsw-alias-label-secondary, #646a73); background: var(--dsw-alias-bg-layer-3, #fff); box-shadow: 0 8px 24px rgb(31 35 41 / 14%); font-size: 11px; line-height: 16px; font-weight: 500; white-space: nowrap; opacity: 0; visibility: hidden; transform: translateY(-3px); pointer-events: none; transition: opacity .15s ease, transform .15s ease, visibility .15s ease; }
-.dim-versionTooltip strong { color: var(--dsw-alias-label-primary, #1f2329); font: 600 11px/16px ui-monospace, SFMono-Regular, Menlo, monospace; }
-.dim-brand:hover .dim-versionTooltip, .dim-brand:focus .dim-versionTooltip { opacity: 1; visibility: visible; transform: translateY(0); }
 .dim-githubAction { position: relative; display: inline-flex; flex: none; }
 .dim-githubLink { min-height: 30px; display: inline-flex; align-items: center; gap: 5px; flex: none; padding: 0 10px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 8px; color: var(--dsw-alias-label-secondary, #646a73); background: var(--dsw-alias-bg-layer-1, #fff); font-size: 12px; line-height: normal; font-weight: 560; text-decoration: none; transition: border-color .15s ease, color .15s ease, background .15s ease; }
 .dim-githubLink:hover { border-color: #aeb3bb; color: var(--dsw-alias-label-primary, #1f2329); background: var(--dsw-alias-interactive-bg-hover, #f7f8fa); }
@@ -247,8 +245,6 @@ const CSS = String.raw`
 .dim-panel .ddt-qrFrame, .dim-panel .ddt-countdown { width: min(270px, 100%); }
 @container (max-width: 680px) {
   .dim-panel .bxf-headingTools, .dim-panel .dxw-tools, .dim-panel .ddt-tools { gap: 6px; }
-  .dim-panel .dim-botCardTop { flex-direction: column; align-items: stretch; }
-  .dim-panel .dim-botHealthGroup { justify-items: start; }
   .dim-panel .dim-bindActions { gap: 6px; }
   .dim-panel .bxf-headingTools .dim-scanButton, .dim-panel .dxw-tools .dim-scanButton, .dim-panel .ddt-tools .dim-scanButton, .dim-panel .dim-credentialButton { gap: 5px; padding-inline: 8px; font-size: 12px; }
   .dim-panel .dim-actionIcon { width: 13px; height: 13px; flex-basis: 13px; }
@@ -272,10 +268,6 @@ const CSS = String.raw`
   .dim-rail { max-height: none; overflow: visible; padding-right: 1px; }
   .dim-channel { min-height: 48px; }
 }
-@media (max-width: 720px) {
-  .dim-panel .dim-botCardTop { flex-direction: column; align-items: stretch; }
-  .dim-panel .dim-botHealthGroup { justify-items: start; }
-}
 @media (max-width: 560px) {
   .dim-title { flex-direction: column; gap: 10px; }
   .dim-title p { white-space: normal; }

package/plugin-src/host/channels/whatsapp/rpc.mjs

@@ -53,8 +53,8 @@ function payloadFailure(endpoint, payload) {
       && payload.confirm === true ? null : 'bot.delete requires a botId and confirm=true.';
   }
   if (endpoint === WHATSAPP_ENDPOINTS.setAccessPolicy) {
-    if (!exactKeys(payload, ['botId', 'accessMode', 'allowedNumbers'])
-      || Object.keys(payload).length !== 3
+    if (!exactKeys(payload, ['botId', 'accessMode', 'allowedNumbers', 'groupAllowedNumbers'])
+      || Object.keys(payload).length !== 4
       || !validId(payload.botId)) return '请输入有效的 WhatsApp 访问模式和电话号码。';
     try {
       normalizeWhatsappAccessPolicy(payload);

package/src/channels/wecom/wecom-bridge.mjs

@@ -296,12 +296,23 @@ function splitUtf8(text, maxBytes = MAX_REPLY_BYTES) {
   return chunks;
 }
 
-function progressText(update) {
-  if (update?.type === 'text') return update.text;
+function thinkingProgressText(update) {
   if (update?.type === 'tool') return t('正在使用{name}…', { name: update.name });
   return update?.text;
 }
 
+function streamContent(thinkingText, answerText = '', { finish = false } = {}) {
+  const thinking = String(thinkingText ?? '')
+    .replace(/<\/?think>/gi, '')
+    .trim();
+  const answer = String(answerText ?? '').trim();
+  if (!thinking) return answer;
+  const thinkBlock = finish || answer
+    ? `<think>${thinking}</think>`
+    : `<think>${thinking}`;
+  return answer ? `${thinkBlock}\n${answer}` : thinkBlock;
+}
+
 function artifactFailureText(fileName, error) {
   const name = String(fileName ?? t('结果文件')).replace(/[\r\n]+/g, ' ').trim()
     || t('结果文件');
@@ -867,6 +878,8 @@ export class WecomHarnessBridge {
     const key = conversationKey(frame);
     let streamId = null;
     let streamStarted = false;
+    let streamThinkingText = t('正在思考中…');
+    let streamAnswerText = '';
     let batchSettled = batchSubmission === null;
     let promptRecorded = false;
     try {
@@ -920,7 +933,12 @@ export class WecomHarnessBridge {
 
       streamId = this.#generateReqId('stream');
       try {
-        await this.#client.replyStream(frame, streamId, t('正在思考中…'), false);
+        await this.#client.replyStream(
+          frame,
+          streamId,
+          streamContent(streamThinkingText),
+          false,
+        );
         streamStarted = true;
       } catch (error) {
         this.#logger.warn?.('[dsh-im:wecom] unable to start a stream; using an active reply:', error);
@@ -945,8 +963,15 @@ export class WecomHarnessBridge {
           control: { owner: this, key },
           onUpdate: streamStarted && typeof this.#client.replyStreamNonBlocking === 'function'
             ? async (update) => {
-                const progress = splitUtf8(progressText(update))[0];
-                if (progress) await this.#client.replyStreamNonBlocking(frame, streamId, progress, false);
+                if (update?.type === 'text') {
+                  streamAnswerText = update.text;
+                } else {
+                  streamThinkingText = thinkingProgressText(update) || streamThinkingText;
+                }
+                const preview = splitUtf8(
+                  streamContent(streamThinkingText, streamAnswerText),
+                )[0];
+                if (preview) await this.#client.replyStreamNonBlocking(frame, streamId, preview, false);
               }
             : undefined,
           onInteraction: (interaction) => this.#handleInteraction(interaction, {
@@ -966,18 +991,20 @@ export class WecomHarnessBridge {
 
       this.#signal?.throwIfAborted();
       const displayAnswer = answerTextForDelivery(answer, artifacts);
-      const chunks = splitUtf8(displayAnswer);
+      const streamChunks = splitUtf8(
+        streamContent(streamThinkingText, displayAnswer, { finish: true }),
+      );
       let finalSent = false;
       let textReceipt = null;
       let textSendError = null;
       try {
-        if (streamStarted && chunks.length > 0) {
+        if (streamStarted && streamChunks.length > 0) {
           try {
             const providerMessageIds = [];
-            const streamed = await this.#client.replyStream(frame, streamId, chunks[0], true);
+            const streamed = await this.#client.replyStream(frame, streamId, streamChunks[0], true);
             const streamedMessageId = providerMessageId(streamed);
             if (streamedMessageId) providerMessageIds.push(streamedMessageId);
-            for (const chunk of chunks.slice(1)) {
+            for (const chunk of streamChunks.slice(1)) {
               const sent = await this.#client.sendMessage(
                 chatId,
                 { msgtype: 'markdown', markdown: { content: chunk } },
@@ -1040,7 +1067,12 @@ export class WecomHarnessBridge {
       }
       if (error?.code === 'turn-stopped') {
         if (streamStarted && streamId) {
-          await this.#client.replyStream(frame, streamId, t('已停止。'), true)
+          await this.#client.replyStream(
+            frame,
+            streamId,
+            streamContent(streamThinkingText, t('已停止。'), { finish: true }),
+            true,
+          )
             .catch(() => undefined);
         }
         if (!promptRecorded) await this.#state.markSeen(messageId);
@@ -1063,7 +1095,12 @@ export class WecomHarnessBridge {
         : errorText;
       try {
         if (streamStarted && streamId) {
-          await this.#client.replyStream(frame, streamId, visibleError, true);
+          await this.#client.replyStream(
+            frame,
+            streamId,
+            streamContent(streamThinkingText, visibleError, { finish: true }),
+            true,
+          );
         } else {
           await this.#sendImmediate(frame, chatId, visibleError);
         }

package/src/channels/whatsapp/config-store.mjs

@@ -63,6 +63,7 @@ export function normalizeWhatsappAccessPolicy(value = {}) {
   return Object.freeze({
     accessMode,
     allowedNumbers: normalizeWhatsappAllowedNumbers(value.allowedNumbers),
+    groupAllowedNumbers: normalizeWhatsappAllowedNumbers(value.groupAllowedNumbers),
   });
 }
 

package/src/channels/whatsapp/whatsapp-controller.mjs

@@ -334,6 +334,7 @@ export class WhatsappController {
       connectedAt: new Date().toISOString(),
       accessMode: previous?.accessMode,
       allowedNumbers: previous?.allowedNumbers,
+      groupAllowedNumbers: previous?.groupAllowedNumbers,
     };
     try {
       if (record.controller.signal.aborted || this.#closed) throw Object.assign(new Error(), { name: 'AbortError' });

package/src/channels/whatsapp/whatsapp-runtime.mjs

@@ -3,6 +3,7 @@ import { createHash, randomBytes } from 'node:crypto';
 import {
   areJidsSameUser,
   downloadMediaMessage,
+  jidNormalizedUser,
   normalizeMessageContent,
 } from '@whiskeysockets/baileys';
 
@@ -13,6 +14,7 @@ import { trackOutboundArtifactProviderPromise } from '../shared/semantic/artifac
 import { createWhatsappBridgeStatus, WhatsappHarnessBridge } from './whatsapp-bridge.mjs';
 import {
   WHATSAPP_ACCESS_MODES,
+  normalizeWhatsappAccountJid,
   normalizeWhatsappAccessPolicy,
 } from './config-store.mjs';
 import { createWhatsappWebSession } from './whatsapp-web-session.mjs';
@@ -204,8 +206,21 @@ export function createWhatsappMediaDownloader({
   });
 }
 
+function whatsappAccountMatcher(accountJid, aliases) {
+  const accountJids = new Set(
+    [accountJid, ...(Array.isArray(aliases) ? aliases : [])]
+      .map((jid) => normalizeWhatsappAccountJid(jidNormalizedUser(jid)))
+      .filter(Boolean),
+  );
+  return (jid) => {
+    const normalized = normalizeWhatsappAccountJid(jidNormalizedUser(jid));
+    return normalized !== null && accountJids.has(normalized);
+  };
+}
+
 export function normalizeWhatsappMessage(message, accountJid, {
   download = downloadMediaMessage,
+  accountAliases = [],
 } = {}) {
   const remoteJid = typeof message?.key?.remoteJid === 'string' ? message.key.remoteJid : '';
   const alternateRemoteJid = typeof message?.key?.remoteJidAlt === 'string'
@@ -215,8 +230,9 @@ export function normalizeWhatsappMessage(message, accountJid, {
     || remoteJid.endsWith('@newsletter')) return null;
   const group = remoteJid.endsWith('@g.us');
   const fromMe = message.key.fromMe === true;
+  const matchesAccount = whatsappAccountMatcher(accountJid, accountAliases);
   const selfChat = fromMe && !group
-    && [remoteJid, alternateRemoteJid].some((jid) => jid && areJidsSameUser(jid, accountJid));
+    && [remoteJid, alternateRemoteJid].some(matchesAccount);
   if (fromMe && !selfChat && !group) return null;
   const senderJid = fromMe ? accountJid : group ? message.key.participant : remoteJid;
   const senderAlternateJid = group && !fromMe ? message.key.participantAlt : alternateRemoteJid;
@@ -225,9 +241,9 @@ export function normalizeWhatsappMessage(message, accountJid, {
   const content = normalizeMessageContent(message.message);
   const context = messageContext(content);
   const mentioned = Array.isArray(context?.mentionedJid)
-    && context.mentionedJid.some((jid) => areJidsSameUser(jid, accountJid));
+    && context.mentionedJid.some(matchesAccount);
   const replyToSelf = typeof context?.participant === 'string'
-    && areJidsSameUser(context.participant, accountJid);
+    && matchesAccount(context.participant);
   const image = whatsappImageSource(message, content, download, { viewOnce });
   const file = whatsappFileSource(message, content, download);
   return {
@@ -235,6 +251,7 @@ export function normalizeWhatsappMessage(message, accountJid, {
     providerMessageId: messageId,
     senderId: senderJid,
     senderAlternateId: typeof senderAlternateJid === 'string' ? senderAlternateJid : '',
+    senderIsSelf: fromMe,
     senderIsBot: false,
     kind: group ? 'group' : 'direct',
     conversationId: remoteJid,
@@ -253,12 +270,22 @@ export function normalizeWhatsappMessage(message, accountJid, {
 export function whatsappInboundAllowed(message, {
   accessMode = WHATSAPP_ACCESS_MODES.selfOnly,
   allowedNumbers = new Set(),
+  groupAllowedNumbers = new Set(),
 } = {}) {
-  if (accessMode === WHATSAPP_ACCESS_MODES.open) return true;
+  if (accessMode === WHATSAPP_ACCESS_MODES.open) {
+    if (message?.kind !== 'group' || message.senderIsSelf === true) return true;
+    if (!(groupAllowedNumbers instanceof Set)) return false;
+    if (groupAllowedNumbers.size === 0) return true;
+    const senderJids = [message.senderId, message.senderAlternateId]
+      .filter((jid) => typeof jid === 'string' && jid.endsWith('@s.whatsapp.net'));
+    return [...groupAllowedNumbers].some((number) => senderJids.some((jid) => (
+      areJidsSameUser(jid, `${number}@s.whatsapp.net`)
+    )));
+  }
   if (message?.kind !== 'direct') return false;
   if (message.selfChat === true) return true;
-  if (accessMode !== WHATSAPP_ACCESS_MODES.privateAllowlist
-    || !(allowedNumbers instanceof Set)) return false;
+  if (accessMode !== WHATSAPP_ACCESS_MODES.privateAllowlist) return false;
+  if (!(allowedNumbers instanceof Set)) return false;
   const senderJids = [message.senderId, message.senderAlternateId]
     .filter((jid) => typeof jid === 'string' && jid.endsWith('@s.whatsapp.net'));
   return [...allowedNumbers].some((number) => senderJids.some((jid) => (
@@ -542,6 +569,7 @@ export class WhatsappRuntime {
   #mediaUploadTimeoutMs;
   #accessMode;
   #allowedPrivateNumbers;
+  #allowedGroupNumbers;
   #createSession;
   #status = createWhatsappRuntimeStatus();
   #abortController = null;
@@ -590,6 +618,7 @@ export class WhatsappRuntime {
     const policy = normalizeWhatsappAccessPolicy(value);
     this.#accessMode = policy.accessMode;
     this.#allowedPrivateNumbers = new Set(policy.allowedNumbers);
+    this.#allowedGroupNumbers = new Set(policy.groupAllowedNumbers);
     this.#config = { ...this.#config, ...policy };
     return policy;
   }
@@ -624,7 +653,13 @@ export class WhatsappRuntime {
           { code: 'relink-required' },
         )),
         onMessage: async (raw, context) => {
+          const linkedAccount = context?.socket?.user;
           const message = normalizeWhatsappMessage(raw, this.#config.accountJid, {
+            accountAliases: [
+              linkedAccount?.id,
+              linkedAccount?.lid,
+              linkedAccount?.phoneNumber,
+            ],
             download: createWhatsappMediaDownloader({
               socket: context?.socket,
               logger: this.#logger,
@@ -635,6 +670,7 @@ export class WhatsappRuntime {
           if (!whatsappInboundAllowed(message, {
             accessMode: this.#accessMode,
             allowedNumbers: this.#allowedPrivateNumbers,
+            groupAllowedNumbers: this.#allowedGroupNumbers,
           })) {
             this.#status.messagesRejected += 1;
             this.#status.lastRejectedAt = new Date().toISOString();