@xmanrui/dsh-im 4.2.1 → 4.4.0

package/src/channels/shared/text-harness-bridge.mjs

@@ -1,4 +1,8 @@
 import { t } from './i18n.mjs';
+import {
+  COMMAND_PERMISSION_DENIED_MESSAGE,
+  evaluateInboundAccess,
+} from './inbound-access.mjs';
 import { captureContextEnhancement, enhanceContextContent } from './context-enhancement.mjs';
 import { runWorkspaceCommand } from './workspace-command.mjs';
 import { runCompactCommand } from './compact-command.mjs';
@@ -129,6 +133,7 @@ export class TextHarnessBridge {
   #harness;
   #state;
   #contextEnhancement;
+  #accessPolicy;
   #status;
   #logger;
   #replyTimeoutMs;
@@ -149,6 +154,7 @@ export class TextHarnessBridge {
     harness,
     state,
     contextEnhancement,
+    accessPolicy,
     status = createTextBridgeStatus(),
     logger = console,
     replyTimeoutMs = 600_000,
@@ -162,6 +168,7 @@ export class TextHarnessBridge {
     this.#harness = harness;
     this.#state = state;
     this.#contextEnhancement = contextEnhancement;
+    this.#accessPolicy = accessPolicy;
     this.#status = status;
     this.#logger = logger;
     this.#replyTimeoutMs = replyTimeoutMs;
@@ -176,7 +183,7 @@ export class TextHarnessBridge {
     return structuredClone(this.#status);
   }
 
-  accept(message, { contextSnapshot } = {}) {
+  accept(message, { contextSnapshot, accessDecision } = {}) {
     if (this.#signal?.aborted) return Promise.resolve();
     const conversationId = cleanText(message?.conversationId);
     const kind = message?.kind === 'group' ? 'group' : 'direct';
@@ -187,6 +194,40 @@ export class TextHarnessBridge {
       || this.#state.hasSeen(messageId) || this.#acceptedMessageIds.has(messageId)) {
       return Promise.resolve();
     }
+    // Preserve the channel trigger boundary. Access policy never turns an
+    // unaddressed group message into a denial reply.
+    if (kind === 'group' && normalized.addressed !== true) {
+      this.#status.messagesRejected += 1;
+      this.#status.lastRejectedAt = new Date().toISOString();
+      this.#acceptedMessageIds.set(messageId, null);
+      return this.#finishLocalMessage(normalized, messageId, null);
+    }
+    if (this.#accessPolicy || accessDecision) {
+      const hasImages = hasInboundImages(normalized);
+      const hasFiles = hasInboundFiles(normalized);
+      const decision = accessDecision ?? evaluateInboundAccess(this.#accessPolicy, {
+        conversationType: kind,
+        senderIds: [senderId, cleanText(normalized.senderAlternateId)].filter(Boolean),
+        text: normalized.content,
+        hasImages,
+        hasFiles,
+      });
+      if (!decision.allowed) {
+        this.#status.messagesRejected += 1;
+        this.#status.lastRejectedAt = new Date().toISOString();
+        // Mark policy denials so a webhook replay cannot repeat local work or
+        // a command-permission notice.
+        this.#acceptedMessageIds.set(messageId, null);
+        return this.#finishLocalMessage(
+          normalized,
+          messageId,
+          decision.reason === 'command-not-allowed'
+            ? t(COMMAND_PERMISSION_DENIED_MESSAGE)
+            : null,
+          { recordReceived: decision.reason === 'command-not-allowed' },
+        );
+      }
+    }
     this.#acceptedMessageIds.set(messageId, contextSnapshot === undefined
       ? captureContextEnhancement(this.#contextEnhancement, message?.kind)
       : contextSnapshot);
@@ -350,13 +391,15 @@ export class TextHarnessBridge {
     return this.#enqueueMessage(normalized, messageId, senderId, key);
   }
 
-  #finishLocalMessage(message, messageId, reply) {
+  #finishLocalMessage(message, messageId, reply, { recordReceived = true } = {}) {
     let task;
     task = (async () => {
       if (this.#state.hasSeen(messageId)) return;
       await this.#state.markSeen(messageId);
-      this.#status.messagesReceived += 1;
-      this.#status.lastMessageAt = new Date().toISOString();
+      if (recordReceived) {
+        this.#status.messagesReceived += 1;
+        this.#status.lastMessageAt = new Date().toISOString();
+      }
       if (reply) await this.#bot.sendText(message.replyTarget, reply);
       this.#status.lastError = null;
     })().catch(async (error) => {

package/src/channels/shared/workspace-command.mjs

@@ -353,7 +353,7 @@ async function runSessionBindCommand(command, harness, conversationKey) {
 }
 
 export async function runWorkspaceCommand(text, harness, conversationKey) {
-  if (typeof text !== 'string') return null;
+  if (!isWorkspaceCommand(text)) return null;
   const command = text.trim();
   if (SESSION_BIND_PREFIX.test(command)) {
     return runSessionBindCommand(command, harness, conversationKey);
@@ -385,3 +385,12 @@ export async function runWorkspaceCommand(text, harness, conversationKey) {
     throw error;
   }
 }
+
+export function isWorkspaceCommand(text) {
+  if (typeof text !== 'string') return false;
+  const command = text.trim();
+  return SESSION_BIND_PREFIX.test(command)
+    || SESSION_LIST_COMMAND.test(command)
+    || WORKSPACE_LIST_COMMAND.test(command)
+    || WORKSPACE_COMMAND.test(command);
+}

package/src/channels/slack/slack-runtime.mjs

@@ -347,6 +347,7 @@ export class SlackRuntime {
   #harness;
   #state;
   #contextEnhancement;
+  #accessPolicy;
   #logger;
   #replyTimeoutMs;
   #connectTimeoutMs;
@@ -371,6 +372,7 @@ export class SlackRuntime {
     harness,
     state,
     contextEnhancement,
+    accessPolicy,
     logger = console,
     replyTimeoutMs = 600_000,
     connectTimeoutMs = 20_000,
@@ -387,6 +389,7 @@ export class SlackRuntime {
     this.#harness = harness;
     this.#state = state;
     this.#contextEnhancement = contextEnhancement;
+    this.#accessPolicy = accessPolicy;
     this.#logger = logger;
     this.#replyTimeoutMs = replyTimeoutMs;
     this.#connectTimeoutMs = connectTimeoutMs;
@@ -464,6 +467,7 @@ export class SlackRuntime {
         harness: this.#harness,
         state: this.#state,
         contextEnhancement: this.#contextEnhancement,
+        accessPolicy: this.#accessPolicy,
         status: this.#status,
         logger: this.#logger,
         replyTimeoutMs: this.#replyTimeoutMs,

package/src/channels/telegram/telegram-runtime.mjs

@@ -14,7 +14,6 @@ import {
 } from './telegram-rich-message.mjs';
 import {
   TELEGRAM_ACCESS_MODES,
-  normalizeTelegramAccessPolicy,
 } from './config-store.mjs';
 
 export const TELEGRAM_COMMAND_MENU = Object.freeze([
@@ -669,12 +668,11 @@ export class TelegramRuntime {
   #harness;
   #state;
   #contextEnhancement;
+  #accessPolicy;
   #logger;
   #replyTimeoutMs;
   #createApi;
   #createHttpTransport;
-  #accessMode;
-  #allowedPrivateUserIds;
   #status = createTelegramRuntimeStatus();
   #httpTransport = null;
   #api = null;
@@ -689,6 +687,7 @@ export class TelegramRuntime {
     harness,
     state,
     contextEnhancement,
+    accessPolicy,
     logger = console,
     replyTimeoutMs = 600_000,
     createApi = (options) => new TelegramApi(options),
@@ -702,13 +701,11 @@ export class TelegramRuntime {
     this.#harness = harness;
     this.#state = state;
     this.#contextEnhancement = contextEnhancement;
+    this.#accessPolicy = accessPolicy;
     this.#logger = logger;
     this.#replyTimeoutMs = replyTimeoutMs;
     this.#createApi = createApi;
     this.#createHttpTransport = createHttpTransport;
-    const accessPolicy = normalizeTelegramAccessPolicy(config);
-    this.#accessMode = accessPolicy.accessMode;
-    this.#allowedPrivateUserIds = new Set(accessPolicy.allowedUsers);
   }
 
   get status() {
@@ -805,6 +802,7 @@ export class TelegramRuntime {
         harness: this.#harness,
         state: this.#state,
         contextEnhancement: this.#contextEnhancement,
+        accessPolicy: this.#accessPolicy,
         status: this.#status,
         logger: this.#logger,
         replyTimeoutMs: this.#replyTimeoutMs,
@@ -865,10 +863,7 @@ export class TelegramRuntime {
           loadFile: (fileId, options) => this.#api.downloadFile({ fileId, ...options }),
           loadFileStream: (fileId, options) => this.#api.downloadFileStream({ fileId, ...options }),
         });
-        if (message && telegramInboundAllowed(message, {
-          accessMode: this.#accessMode,
-          allowedPrivateUserIds: this.#allowedPrivateUserIds,
-        })) {
+        if (message) {
           void this.#bridge.accept(message, { contextSnapshot }).catch((error) => {
             if (signal.aborted) return;
             this.#logger.error?.(
@@ -876,9 +871,6 @@ export class TelegramRuntime {
               error,
             );
           });
-        } else if (message) {
-          this.#status.messagesRejected += 1;
-          this.#status.lastRejectedAt = new Date().toISOString();
         }
         cursor = update.update_id + 1;
         await this.#state.setCursor(cursor);

package/src/channels/wecom/wecom-bridge.mjs

@@ -51,6 +51,10 @@ import {
   messageFailureText,
   setLastMessageFailure,
 } from '../shared/message-failure.mjs';
+import {
+  COMMAND_PERMISSION_DENIED_MESSAGE,
+  evaluateInboundAccess,
+} from '../shared/inbound-access.mjs';
 import { t } from '../shared/i18n.mjs';
 
 const DEFAULT_FILE_UPLOAD_TIMEOUT_MS = 120_000;
@@ -490,6 +494,7 @@ export class WecomHarnessBridge {
   #harness;
   #state;
   #contextEnhancement;
+  #accessPolicy;
   #status;
   #logger;
   #replyTimeoutMs;
@@ -512,6 +517,7 @@ export class WecomHarnessBridge {
     harness,
     state,
     contextEnhancement,
+    accessPolicy,
     status = createWecomBridgeStatus(),
     logger = console,
     replyTimeoutMs = 600_000,
@@ -530,6 +536,7 @@ export class WecomHarnessBridge {
     this.#harness = harness;
     this.#state = state;
     this.#contextEnhancement = contextEnhancement;
+    this.#accessPolicy = accessPolicy;
     this.#status = status;
     this.#logger = logger;
     this.#replyTimeoutMs = replyTimeoutMs;
@@ -557,16 +564,28 @@ export class WecomHarnessBridge {
       || this.#acceptedMessageIds.has(messageId)) return Promise.resolve();
 
     const key = conversationKey(frame);
+    const pending = this.#pendingInteractions.get(key);
+    const commandMessage = wecomInboundMessage(frame, this.#client);
+    const commandText = nonEmptyString(commandMessage.content) ?? '';
+    const conversationType = body.chattype === 'single' ? 'direct' : 'group';
+    const access = evaluateInboundAccess(this.#accessPolicy, {
+      conversationType,
+      senderIds: senderId,
+      text: commandText,
+      hasImages: hasInboundImages(commandMessage),
+      hasFiles: hasInboundFiles(commandMessage),
+    });
+    if (!access.allowed) {
+      this.#acceptedMessageIds.set(messageId, null);
+      return this.#finishAccessDecision(frame, messageId, chatId, access);
+    }
     this.#acceptedMessageIds.set(messageId, captureContextEnhancement(
       this.#contextEnhancement,
-      body.chattype === 'single' ? 'direct' : 'group',
+      conversationType,
     ));
     if (body.chattype === 'single') {
       rememberConnectionTestTarget(this.#state, { chatId });
     }
-    const pending = this.#pendingInteractions.get(key);
-    const commandMessage = wecomInboundMessage(frame, this.#client);
-    const commandText = nonEmptyString(commandMessage.content) ?? '';
     const batchCommand = isBatchInputCommand(commandText);
     const batchStatus = this.#batchInputs.status(key);
     if (batchCommand && body.chattype === 'group') {
@@ -760,6 +779,34 @@ export class WecomHarnessBridge {
     return task;
   }
 
+  #finishAccessDecision(frame, messageId, chatId, access) {
+    let task;
+    task = Promise.resolve().then(async () => {
+      if (this.#state.hasSeen(messageId)) return;
+      await this.#state.markSeen(messageId);
+      if (access.reason === 'command-not-allowed') {
+        this.#status.messagesReceived += 1;
+        this.#status.lastMessageAt = new Date().toISOString();
+        await this.#sendImmediate(frame, chatId, t(COMMAND_PERMISSION_DENIED_MESSAGE));
+        this.#status.messagesReplied += 1;
+        this.#status.lastReplyAt = new Date().toISOString();
+      } else {
+        this.#status.messagesRejected += 1;
+        this.#status.lastRejectedAt = new Date().toISOString();
+      }
+      this.#status.lastError = null;
+    }).catch((error) => {
+      if (this.#signal?.aborted) return;
+      this.#status.lastError = error?.message ?? String(error);
+      this.#logger.error?.('[dsh-im:wecom] failed to apply inbound access policy', error);
+    }).finally(() => {
+      this.#acceptedMessageIds.delete(messageId);
+      this.#commandTasks.delete(task);
+    });
+    this.#commandTasks.add(task);
+    return task;
+  }
+
   async waitForIdle() {
     await Promise.allSettled([
       ...this.#queues.values(),

package/src/channels/wecom/wecom-runtime.mjs

@@ -29,6 +29,7 @@ export class WecomRuntime {
   #harness;
   #state;
   #contextEnhancement;
+  #accessPolicy;
   #logger;
   #replyTimeoutMs;
   #connectTimeoutMs;
@@ -47,6 +48,7 @@ export class WecomRuntime {
     harness,
     state,
     contextEnhancement,
+    accessPolicy,
     logger = console,
     replyTimeoutMs = 600_000,
     connectTimeoutMs = 20_000,
@@ -61,6 +63,7 @@ export class WecomRuntime {
     this.#harness = harness;
     this.#state = state;
     this.#contextEnhancement = contextEnhancement;
+    this.#accessPolicy = accessPolicy;
     this.#logger = logger;
     this.#replyTimeoutMs = replyTimeoutMs;
     this.#connectTimeoutMs = connectTimeoutMs;
@@ -111,6 +114,7 @@ export class WecomRuntime {
       harness: this.#harness,
       state: this.#state,
       contextEnhancement: this.#contextEnhancement,
+      accessPolicy: this.#accessPolicy,
       status: this.#status,
       logger: this.#logger,
       replyTimeoutMs: this.#replyTimeoutMs,

package/src/channels/weixin/weixin-bridge.mjs

@@ -57,6 +57,10 @@ import {
   messageFailureText,
   setLastMessageFailure,
 } from '../shared/message-failure.mjs';
+import {
+  COMMAND_PERMISSION_DENIED_MESSAGE,
+  evaluateInboundAccess,
+} from '../shared/inbound-access.mjs';
 import { t } from '../shared/i18n.mjs';
 
 const INTERACTION_RESOLVED_TEXT = () => t('这个问题已在其他客户端处理，无需再次回答。');
@@ -260,6 +264,7 @@ export class WeixinHarnessBridge {
   #harness;
   #state;
   #contextEnhancement;
+  #accessPolicy;
   #status;
   #logger;
   #replyTimeoutMs;
@@ -292,6 +297,7 @@ export class WeixinHarnessBridge {
     harness,
     state,
     contextEnhancement,
+    accessPolicy,
     status = createWeixinBridgeStatus(),
     logger = console,
     replyTimeoutMs = 600_000,
@@ -312,6 +318,7 @@ export class WeixinHarnessBridge {
     this.#harness = harness;
     this.#state = state;
     this.#contextEnhancement = contextEnhancement;
+    this.#accessPolicy = accessPolicy;
     this.#status = status;
     this.#logger = logger;
     this.#replyTimeoutMs = replyTimeoutMs;
@@ -332,6 +339,22 @@ export class WeixinHarnessBridge {
     const sender = nonEmptyString(message?.from_user_id);
     if (!messageId || !sender || this.#state.hasSeen(messageId)
       || this.#acceptedMessageIds.has(messageId)) return Promise.resolve();
+    const commandText = nonEmptyString(extractWeixinText(message)) ?? '';
+    const access = this.#accessPolicy
+      ? evaluateInboundAccess(this.#accessPolicy, {
+          conversationType: 'direct',
+          senderIds: sender,
+          text: commandText,
+          hasImages: hasWeixinImageItems(message),
+          hasFiles: hasWeixinFileItems(message),
+        })
+      : sender === this.#ownerUserId
+        ? { allowed: true, reason: 'legacy-owner' }
+        : { allowed: false, reason: 'sender-not-allowed' };
+    if (!access.allowed) {
+      this.#acceptedMessageIds.set(messageId, null);
+      return this.#finishAccessDecision(messageId, sender, message, access);
+    }
     this.#acceptedMessageIds.set(messageId, captureContextEnhancement(
       this.#contextEnhancement,
       'direct',
@@ -343,11 +366,9 @@ export class WeixinHarnessBridge {
     const contextToken = nonEmptyString(message?.context_token) ?? undefined;
     const runId = nonEmptyString(message?.run_id) ?? undefined;
     const pending = this.#pendingInteractions.get(key);
-    const commandText = nonEmptyString(extractWeixinText(message)) ?? '';
     const batchCommand = isBatchInputCommand(commandText);
     const batchStatus = this.#batchInputs.status(key);
-    if (sender === this.#ownerUserId
-      && (batchCommand || batchStatus.phase === 'collecting')) {
+    if (batchCommand || batchStatus.phase === 'collecting') {
       const exactBatchStart = /^\/batch$/iu.test(commandText);
       const result = exactBatchStart
         && batchStatus.phase === 'idle'
@@ -380,7 +401,7 @@ export class WeixinHarnessBridge {
       : (isModelCommand(commandText)
           ? runModelCommand
           : (isPresetCommand(commandText) ? runPresetCommand : null));
-    if (commandRunner && sender === this.#ownerUserId) {
+    if (commandRunner) {
       let task;
       task = this.#processFastCommand(
         message,
@@ -467,12 +488,10 @@ export class WeixinHarnessBridge {
     alreadyRecorded = false,
     batchSubmission = null,
   } = {}) {
-    const preparedMessage = message.from_user_id === this.#ownerUserId
-      ? prefetchInboundFiles(
-          weixinInboundMessage(message, this.#api),
-          { signal: this.#signal },
-        )
-      : undefined;
+    const preparedMessage = prefetchInboundFiles(
+      weixinInboundMessage(message, this.#api),
+      { signal: this.#signal },
+    );
     const previous = this.#queues.get(key) ?? Promise.resolve();
     const current = previous
       .catch(() => undefined)
@@ -518,6 +537,36 @@ export class WeixinHarnessBridge {
     return task;
   }
 
+  #finishAccessDecision(messageId, sender, message, access) {
+    const contextToken = nonEmptyString(message?.context_token) ?? undefined;
+    const runId = nonEmptyString(message?.run_id) ?? undefined;
+    let task;
+    task = Promise.resolve().then(async () => {
+      if (this.#state.hasSeen(messageId)) return;
+      await this.#state.markSeen(messageId);
+      if (access.reason === 'command-not-allowed') {
+        this.#status.messagesReceived += 1;
+        this.#status.lastMessageAt = new Date().toISOString();
+        await this.#send(sender, t(COMMAND_PERMISSION_DENIED_MESSAGE), contextToken, runId);
+        this.#status.messagesReplied += 1;
+        this.#status.lastReplyAt = new Date().toISOString();
+      } else {
+        this.#status.messagesRejected += 1;
+        this.#status.lastRejectedAt = new Date().toISOString();
+      }
+      this.#status.lastError = null;
+    }).catch((error) => {
+      if (this.#signal?.aborted) return;
+      this.#status.lastError = error?.message ?? String(error);
+      this.#logger.error?.('[dsh-weixin] failed to apply inbound access policy:', error);
+    }).finally(() => {
+      this.#acceptedMessageIds.delete(messageId);
+      this.#commandTasks.delete(task);
+    });
+    this.#commandTasks.add(task);
+    return task;
+  }
+
   async waitForIdle() {
     await Promise.allSettled([
       ...this.#queues.values(),
@@ -590,12 +639,6 @@ export class WeixinHarnessBridge {
       this.#status.messagesReceived += 1;
       this.#status.lastMessageAt = new Date().toISOString();
     }
-    if (sender !== this.#ownerUserId) {
-      this.#status.messagesRejected += 1;
-      this.#status.lastRejectedAt = new Date().toISOString();
-      return;
-    }
-
     const contextToken = typeof message.context_token === 'string' ? message.context_token : undefined;
     const runId = typeof message.run_id === 'string' ? message.run_id : undefined;
     let batchSettled = batchSubmission === null;

package/src/channels/weixin/weixin-runtime.mjs

@@ -109,6 +109,7 @@ export class WeixinRuntime {
   #harness;
   #state;
   #contextEnhancement;
+  #accessPolicy;
   #logger;
   #replyTimeoutMs;
   #maxMessageChars;
@@ -126,6 +127,7 @@ export class WeixinRuntime {
     harness,
     state,
     contextEnhancement,
+    accessPolicy,
     logger = console,
     replyTimeoutMs = 600_000,
     maxMessageChars = DEFAULT_WEIXIN_MAX_MESSAGE_CHARS,
@@ -140,6 +142,7 @@ export class WeixinRuntime {
     this.#harness = harness;
     this.#state = state;
     this.#contextEnhancement = contextEnhancement;
+    this.#accessPolicy = accessPolicy;
     this.#logger = logger;
     this.#replyTimeoutMs = replyTimeoutMs;
     this.#maxMessageChars = maxMessageChars;
@@ -182,6 +185,7 @@ export class WeixinRuntime {
         harness: this.#harness,
         state: this.#state,
         contextEnhancement: this.#contextEnhancement,
+        accessPolicy: this.#accessPolicy,
         status: this.#status,
         logger: this.#logger,
         replyTimeoutMs: this.#replyTimeoutMs,

package/src/channels/whatsapp/whatsapp-runtime.mjs

@@ -3,6 +3,7 @@ import { createHash, randomBytes } from 'node:crypto';
 import {
   areJidsSameUser,
   downloadMediaMessage,
+  jidDecode,
   normalizeMessageContent,
 } from '@whiskeysockets/baileys';
 
@@ -13,7 +14,6 @@ import { trackOutboundArtifactProviderPromise } from '../shared/semantic/artifac
 import { createWhatsappBridgeStatus, WhatsappHarnessBridge } from './whatsapp-bridge.mjs';
 import {
   WHATSAPP_ACCESS_MODES,
-  normalizeWhatsappAccessPolicy,
 } from './config-store.mjs';
 import { createWhatsappWebSession } from './whatsapp-web-session.mjs';
 
@@ -37,6 +37,36 @@ const VIEW_ONCE_WRAPPER_KEYS = new Set([
   'viewOnceMessageV2',
   'viewOnceMessageV2Extension',
 ]);
+const WHATSAPP_ACCESS_POLICY_USER_SERVERS = new Set([
+  's.whatsapp.net',
+  'c.us',
+  'lid',
+  'hosted',
+  'hosted.lid',
+]);
+
+function normalizeWhatsappAccessPolicyId(value) {
+  if (typeof value !== 'string') return null;
+  const candidate = value.trim();
+  if (/^\+?\d+$/.test(candidate)) {
+    return `${candidate.replace(/^\+/, '')}@s.whatsapp.net`;
+  }
+  const decoded = jidDecode(candidate);
+  if (!decoded || !/^\d+$/.test(decoded.user)
+    || !WHATSAPP_ACCESS_POLICY_USER_SERVERS.has(decoded.server)) return null;
+  return candidate;
+}
+
+export function whatsappAccessPolicyIdsEqual(left, right) {
+  const normalizedLeft = normalizeWhatsappAccessPolicyId(left);
+  const normalizedRight = normalizeWhatsappAccessPolicyId(right);
+  if (!normalizedLeft || !normalizedRight) return false;
+  try {
+    return areJidsSameUser(normalizedLeft, normalizedRight) === true;
+  } catch {
+    return false;
+  }
+}
 
 function hasViewOnceWrapper(content) {
   let current = content;
@@ -538,12 +568,11 @@ export class WhatsappRuntime {
   #harness;
   #state;
   #contextEnhancement;
+  #accessPolicy;
   #logger;
   #replyTimeoutMs;
   #connectTimeoutMs;
   #mediaUploadTimeoutMs;
-  #accessMode;
-  #allowedPrivateNumbers;
   #createSession;
   #status = createWhatsappRuntimeStatus();
   #abortController = null;
@@ -558,6 +587,7 @@ export class WhatsappRuntime {
     harness,
     state,
     contextEnhancement,
+    accessPolicy,
     logger = console,
     replyTimeoutMs = 600_000,
     connectTimeoutMs = 30_000,
@@ -572,6 +602,7 @@ export class WhatsappRuntime {
     this.#harness = harness;
     this.#state = state;
     this.#contextEnhancement = contextEnhancement;
+    this.#accessPolicy = accessPolicy;
     this.#logger = logger;
     this.#replyTimeoutMs = replyTimeoutMs;
     this.#connectTimeoutMs = connectTimeoutMs;
@@ -583,21 +614,12 @@ export class WhatsappRuntime {
       WHATSAPP_MEDIA_UPLOAD_TIMEOUT_MS,
     );
     this.#createSession = createSession;
-    this.setAccessPolicy(config);
   }
 
   get status() {
     return structuredClone(this.#status);
   }
 
-  setAccessPolicy(value) {
-    const policy = normalizeWhatsappAccessPolicy(value);
-    this.#accessMode = policy.accessMode;
-    this.#allowedPrivateNumbers = new Set(policy.allowedNumbers);
-    this.#config = { ...this.#config, ...policy };
-    return policy;
-  }
-
   async start() {
     if (this.#status.ready && this.#session) return this.status;
     if (this.#starting) return this.#starting;
@@ -636,14 +658,6 @@ export class WhatsappRuntime {
           });
           if (!message || outboundIds.has(message.providerMessageId) || !this.#bridge) return;
           this.#status.lastCheckedAt = Date.now();
-          if (!whatsappInboundAllowed(message, {
-            accessMode: this.#accessMode,
-            allowedNumbers: this.#allowedPrivateNumbers,
-          })) {
-            this.#status.messagesRejected += 1;
-            this.#status.lastRejectedAt = new Date().toISOString();
-            return;
-          }
           await this.#bridge.accept(message);
         },
         onDisconnect: ({ error }) => {
@@ -678,6 +692,14 @@ export class WhatsappRuntime {
         harness: this.#harness,
         state: this.#state,
         contextEnhancement: this.#contextEnhancement,
+        accessPolicy: this.#accessPolicy ? {
+          botId: this.#accessPolicy.botId,
+          getSettings: (...args) => this.#accessPolicy.getSettings(...args),
+          ...(typeof this.#accessPolicy.isPrivileged === 'function' ? {
+            isPrivileged: (...args) => this.#accessPolicy.isPrivileged(...args),
+          } : {}),
+          equals: whatsappAccessPolicyIdsEqual,
+        } : undefined,
         status: this.#status,
         logger: this.#logger,
         replyTimeoutMs: this.#replyTimeoutMs,