beecork 1.4.11 → 1.6.0

package/dist/channels/voice-state.js

@@ -0,0 +1,45 @@
+import { initVoiceProviders } from '../voice/index.js';
+/**
+ * Per-channel STT/TTS state. Used to be duplicated across Telegram, WhatsApp,
+ * and Discord; consolidated here so init + warmup + transcription happen the
+ * same way across all 3.
+ *
+ * Discord historically only called warmup() and did NOT transcribe — preserve
+ * that behavior unless the caller explicitly asks for transcription.
+ */
+export class VoiceState {
+    channelId;
+    stt = null;
+    tts = null;
+    warmedUp = false;
+    constructor(channelId) {
+        this.channelId = channelId;
+    }
+    init(config) {
+        const { stt, tts } = initVoiceProviders(config.voice);
+        this.stt = stt;
+        this.tts = tts;
+    }
+    /** One-shot warmup (no media). Used by Discord today. */
+    async warmup() {
+        if (this.warmedUp || !this.stt)
+            return;
+        try {
+            this.stt.warmup?.();
+        }
+        catch {
+            /* warmup is best-effort */
+        }
+        this.warmedUp = true;
+    }
+    /**
+     * Transcribe voice attachments in-place (mutates the caption fields).
+     * Returns the updated warmed-up flag. No-op if STT isn't configured.
+     */
+    async transcribe(media) {
+        if (!this.stt)
+            return;
+        const { transcribeVoiceMessages } = await import('../voice/index.js');
+        this.warmedUp = await transcribeVoiceMessages(media, this.stt, this.channelId, this.warmedUp);
+    }
+}

package/dist/channels/webhook.d.ts

@@ -1,16 +1,13 @@
-import type { Channel, ChannelContext, InboundMessageHandler, SendOptions } from './types.js';
+import type { Channel, ChannelContext, SendOptions } from './types.js';
 export declare class WebhookChannel implements Channel {
     readonly id = "webhook";
     readonly name = "Webhook";
-    readonly maxMessageLength = 100000;
-    readonly supportsStreaming = false;
-    readonly supportsMedia = false;
+    readonly maxMessageLength: 100000;
     private server;
     private ctx;
     constructor(ctx: ChannelContext);
     start(): Promise<void>;
     stop(): void;
-    onMessage(_handler: InboundMessageHandler): void;
     sendMessage(_peerId: string, _text: string, _options?: SendOptions): Promise<void>;
     sendNotification(_message: string, _urgent?: boolean): Promise<void>;
     setTyping(_peerId: string, _active: boolean): Promise<void>;

package/dist/channels/webhook.js

@@ -1,13 +1,26 @@
 import http from 'node:http';
 import crypto from 'node:crypto';
 import { logger } from '../util/logger.js';
-import { validateTabName } from '../config.js';
+import { validateTabNameOrDefault } from '../config.js';
+import { inboundLimiter } from '../util/rate-limiter.js';
+import { MESSAGE_LIMITS } from '../util/text.js';
+import { processInboundMessage } from './pipeline.js';
+function safeEqualString(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ab.length !== bb.length)
+        return false;
+    try {
+        return crypto.timingSafeEqual(ab, bb);
+    }
+    catch {
+        return false;
+    }
+}
 export class WebhookChannel {
     id = 'webhook';
     name = 'Webhook';
-    maxMessageLength = 100000; // Webhooks can handle large payloads
-    supportsStreaming = false;
-    supportsMedia = false;
+    maxMessageLength = MESSAGE_LIMITS.WEBHOOK_PROMPT;
     server = null;
     ctx;
     constructor(ctx) {
@@ -17,6 +30,16 @@ export class WebhookChannel {
         const config = this.getConfig();
         if (!config?.enabled)
             return;
+        // Fail-secure: a webhook running with no auth turns localhost-injected
+        // prompts (from any local process or any user on a shared host) into
+        // arbitrary claude --dangerously-skip-permissions runs. Require either
+        // an authToken or hmacSecret, OR an explicit allowUnauthLocalhost opt-in.
+        if (!config.authToken && !config.hmacSecret && !config.allowUnauthLocalhost) {
+            logger.error('Webhook channel refusing to start: no authToken or hmacSecret configured. ' +
+                'Set one in ~/.beecork/config.json under webhook.authToken/hmacSecret, or ' +
+                'explicitly opt in with webhook.allowUnauthLocalhost=true (NOT recommended on shared hosts).');
+            return;
+        }
         const port = config.port || 8374;
         this.server = http.createServer(async (req, res) => {
             // CORS headers for API clients
@@ -40,22 +63,21 @@ export class WebhookChannel {
                 return;
             }
             const tabName = decodeURIComponent(match[1]);
-            // Validate tab name
-            if (tabName !== 'default') {
-                const tabError = validateTabName(tabName);
-                if (tabError) {
-                    res.writeHead(400);
-                    res.end(JSON.stringify({ error: tabError }));
-                    return;
-                }
+            // Validate tab name (allow "default" — it's a reference, not a creation)
+            const tabError = validateTabNameOrDefault(tabName);
+            if (tabError) {
+                res.writeHead(400);
+                res.end(JSON.stringify({ error: tabError }));
+                return;
             }
             // Read body first (needed for both JSON parsing and HMAC verification)
             let body = '';
             for await (const chunk of req) {
                 body += chunk;
-                if (body.length > 1024 * 1024) { // 1MB limit
+                if (body.length > MESSAGE_LIMITS.HTTP_BODY) {
                     res.writeHead(413);
                     res.end(JSON.stringify({ error: 'Payload too large' }));
+                    req.destroy();
                     return;
                 }
             }
@@ -65,6 +87,12 @@ export class WebhookChannel {
                 res.end(JSON.stringify({ error: 'Unauthorized' }));
                 return;
             }
+            // Rate-limit AFTER auth so unauthenticated callers don't burn the budget
+            if (!inboundLimiter.check(this.id)) {
+                res.writeHead(429);
+                res.end(JSON.stringify({ error: 'Rate limit exceeded' }));
+                return;
+            }
             let payload;
             try {
                 payload = JSON.parse(body);
@@ -81,23 +109,57 @@ export class WebhookChannel {
                 return;
             }
             const isSync = payload.sync ?? false;
+            const remote = req.socket.remoteAddress ?? 'webhook';
             try {
                 if (isSync) {
-                    // Sync mode: wait for Claude response
-                    const result = await this.ctx.tabManager.sendMessage(tabName, prompt);
-                    res.writeHead(result.error ? 500 : 200);
+                    // Sync mode: route through the shared pipeline so routing/enrichment apply.
+                    const result = await processInboundMessage({
+                        text: prompt,
+                        media: [],
+                        channelId: this.id,
+                        tabManager: this.ctx.tabManager,
+                        userId: remote,
+                        sendProgress: () => {
+                            /* webhook has no progress channel */
+                        },
+                        overrideTabName: tabName,
+                    });
+                    res.writeHead(result.isError ? 500 : 200);
                     res.end(JSON.stringify({
-                        text: result.text,
-                        tab: tabName,
-                        costUsd: result.costUsd,
-                        durationMs: result.durationMs,
-                        error: result.error,
+                        text: result.responseText,
+                        tab: result.tabName,
+                        error: result.isError ? result.responseText : undefined,
                     }));
                 }
                 else {
-                    // Async mode: accept and process in background
-                    this.ctx.tabManager.sendMessage(tabName, prompt).catch(err => {
+                    // Async mode: fire-and-forget through the pipeline.
+                    // Surface failures to the user via broadcastNotify since the HTTP response
+                    // is already 202 and the caller has no other way to learn.
+                    processInboundMessage({
+                        text: prompt,
+                        media: [],
+                        channelId: this.id,
+                        tabManager: this.ctx.tabManager,
+                        userId: remote,
+                        sendProgress: () => {
+                            /* webhook has no progress channel */
+                        },
+                        overrideTabName: tabName,
+                    })
+                        .then((result) => {
+                        if (result.isError && this.ctx.notifyCallback) {
+                            this.ctx
+                                .notifyCallback(`Webhook async failed for "${tabName}": ${result.responseText}`)
+                                .catch(() => { });
+                        }
+                    })
+                        .catch((err) => {
                         logger.error(`Webhook async processing failed for tab ${tabName}:`, err);
+                        if (this.ctx.notifyCallback) {
+                            this.ctx
+                                .notifyCallback(`Webhook async failed for "${tabName}": ${err instanceof Error ? err.message : String(err)}`)
+                                .catch(() => { });
+                        }
                     });
                     res.writeHead(202);
                     res.end(JSON.stringify({ accepted: true, tab: tabName }));
@@ -120,9 +182,6 @@ export class WebhookChannel {
         }
         logger.info('Webhook channel stopped');
     }
-    onMessage(_handler) {
-        // Webhooks handle messages directly in the HTTP handler
-    }
     async sendMessage(_peerId, _text, _options) {
         // Webhooks are request-response — responses are sent in the HTTP handler
     }
@@ -136,10 +195,10 @@ export class WebhookChannel {
         // No auth configured = allow all (localhost only)
         if (!config.authToken && !config.hmacSecret)
             return true;
-        // Bearer token auth
+        // Bearer token auth (constant-time compare)
         if (config.authToken) {
-            const authHeader = req.headers.authorization;
-            if (authHeader === `Bearer ${config.authToken}`)
+            const authHeader = req.headers.authorization || '';
+            if (safeEqualString(authHeader, `Bearer ${config.authToken}`))
                 return true;
         }
         // HMAC signature auth (for GitHub-style webhooks)

package/dist/channels/whatsapp.d.ts

@@ -1,26 +1,28 @@
-import type { Channel, ChannelContext, InboundMessageHandler, SendOptions } from './types.js';
+import type { Channel, ChannelContext, SendOptions } from './types.js';
 export declare class WhatsAppChannel implements Channel {
     readonly id = "whatsapp";
     readonly name = "WhatsApp";
     readonly maxMessageLength = 8192;
-    readonly supportsStreaming = false;
-    readonly supportsMedia = true;
     private sock;
     private ctx;
     private allowedNumbers;
     private reconnectAttempts;
     private readonly maxReconnectAttempts;
     private readonly backoffDelays;
-    private sttProvider;
-    private ttsProvider;
-    private sttWarmedUp;
+    private voice;
     constructor(ctx: ChannelContext);
+    /**
+     * Schedule the next reconnect with exponential backoff. Unlike the previous
+     * inline setTimeout, this path retries when `start()` itself rejects (auth
+     * failure, baileys init throw, etc.) instead of going permanently silent
+     * after a single failed attempt.
+     */
+    private scheduleReconnect;
     start(): Promise<void>;
     stop(): void;
     sendMessage(peerId: string, text: string, _options?: SendOptions): Promise<void>;
     sendNotification(message: string, _urgent?: boolean): Promise<void>;
     setTyping(peerId: string, active: boolean): Promise<void>;
-    onMessage(_handler: InboundMessageHandler): void;
     private sendResponse;
     private isAllowed;
 }

package/dist/channels/whatsapp.js

@@ -1,39 +1,76 @@
+/*
+ * WhatsApp integration via @whiskeysockets/baileys.
+ *
+ * baileys is a peer-optional dependency loaded by dynamic import, and its
+ * runtime types are intentionally loose (the lib uses heavy union/index
+ * types that don't survive serialization across the dynamic-import boundary).
+ * Trying to type every variant of Baileys' message/connection shapes would
+ * either pull baileys into the static graph (bloating non-WhatsApp installs)
+ * or require maintaining a parallel shim. We accept `any` at this trust
+ * boundary; runtime validation lives in the descriptors table inside
+ * messages.upsert.
+ */
+/* eslint-disable @typescript-eslint/no-explicit-any */
 import fs from 'node:fs';
 import { logger } from '../util/logger.js';
 import { saveMedia, isOversized } from '../media/store.js';
-import { retryWithBackoff } from '../util/retry.js';
-import { chunkText } from '../util/text.js';
+import { sendChunkedResponse } from './send-helpers.js';
 import { inboundLimiter } from '../util/rate-limiter.js';
 import { processInboundMessage } from './pipeline.js';
-import { initVoiceProviders } from '../voice/index.js';
+import { isChannelAdmin } from './admin.js';
+import { VoiceState } from './voice-state.js';
 const WHATSAPP_MAX_LENGTH = 8192;
 export class WhatsAppChannel {
     id = 'whatsapp';
     name = 'WhatsApp';
     maxMessageLength = WHATSAPP_MAX_LENGTH;
-    supportsStreaming = false;
-    supportsMedia = true;
     sock = null;
     ctx;
     allowedNumbers;
     reconnectAttempts = 0;
     maxReconnectAttempts = 10;
     backoffDelays = [1000, 5000, 15000, 30000, 60000];
-    sttProvider = null;
-    ttsProvider = null;
-    sttWarmedUp = false;
+    voice = new VoiceState('whatsapp');
     constructor(ctx) {
         this.ctx = ctx;
         this.allowedNumbers = new Set(ctx.config.whatsapp?.allowedNumbers ?? []);
     }
+    /**
+     * Schedule the next reconnect with exponential backoff. Unlike the previous
+     * inline setTimeout, this path retries when `start()` itself rejects (auth
+     * failure, baileys init throw, etc.) instead of going permanently silent
+     * after a single failed attempt.
+     */
+    scheduleReconnect() {
+        this.reconnectAttempts++;
+        if (this.reconnectAttempts > this.maxReconnectAttempts) {
+            logger.error(`WhatsApp reconnect failed after ${this.maxReconnectAttempts} attempts, giving up`);
+            this.ctx
+                .notifyCallback?.('⚠️ WhatsApp disconnected after 10 reconnection attempts. Restart daemon to reconnect.')
+                .catch((err) => logger.error('Failed to send WhatsApp disconnect notification:', err));
+            return;
+        }
+        const delayIdx = Math.min(this.reconnectAttempts - 1, this.backoffDelays.length - 1);
+        const delay = this.backoffDelays[delayIdx];
+        logger.warn(`WhatsApp connection closed, reconnecting in ${delay / 1000}s (attempt ${this.reconnectAttempts}/${this.maxReconnectAttempts})...`);
+        setTimeout(() => {
+            this.start().catch((err) => {
+                logger.error('WhatsApp reconnect attempt failed:', err);
+                // Recurse via scheduleReconnect so backoff keeps escalating instead of
+                // silently dropping the reconnect chain after one failed start().
+                this.scheduleReconnect();
+            });
+        }, delay);
+    }
     async start() {
-        // Initialize voice providers
-        const { stt, tts } = initVoiceProviders(this.ctx.config.voice);
-        this.sttProvider = stt;
-        this.ttsProvider = tts;
+        // Initialize voice providers (STT + TTS)
+        this.voice.init(this.ctx.config);
         try {
-            const { default: makeWASocket, useMultiFileAuthState, DisconnectReason, downloadMediaMessage, fetchLatestBaileysVersion } = await import('@whiskeysockets/baileys');
-            const sessionPath = this.ctx.config.whatsapp?.sessionPath ?? `${process.env.HOME}/.beecork/whatsapp-session`;
+            const { default: makeWASocket, useMultiFileAuthState, DisconnectReason, downloadMediaMessage, fetchLatestBaileysVersion, } = await import('@whiskeysockets/baileys');
+            const { getWhatsappSessionPath } = await import('../util/paths.js');
+            // Use the centralized path helper — the previous fallback hard-coded
+            // process.env.HOME which bypassed BEECORK_HOME for tests/isolation.
+            const sessionPath = this.ctx.config.whatsapp?.sessionPath ?? getWhatsappSessionPath();
             fs.mkdirSync(sessionPath, { recursive: true, mode: 0o700 });
             const { state, saveCreds } = await useMultiFileAuthState(sessionPath);
             const { version } = await fetchLatestBaileysVersion().catch(() => ({ version: undefined }));
@@ -60,21 +97,7 @@ export class WhatsAppChannel {
                 if (connection === 'close') {
                     const reason = lastDisconnect?.error?.output?.statusCode;
                     if (reason !== DisconnectReason.loggedOut) {
-                        this.reconnectAttempts++;
-                        if (this.reconnectAttempts > this.maxReconnectAttempts) {
-                            logger.error(`WhatsApp reconnect failed after ${this.maxReconnectAttempts} attempts, giving up`);
-                            this.ctx.notifyCallback?.('⚠️ WhatsApp disconnected after 10 reconnection attempts. Restart daemon to reconnect.')
-                                .catch(err => logger.error('Failed to send WhatsApp disconnect notification:', err));
-                            return;
-                        }
-                        const delayIdx = Math.min(this.reconnectAttempts - 1, this.backoffDelays.length - 1);
-                        const delay = this.backoffDelays[delayIdx];
-                        logger.warn(`WhatsApp connection closed, reconnecting in ${delay / 1000}s (attempt ${this.reconnectAttempts}/${this.maxReconnectAttempts})...`);
-                        setTimeout(() => {
-                            this.start().catch(err => {
-                                logger.error('WhatsApp reconnect failed:', err);
-                            });
-                        }, delay);
+                        this.scheduleReconnect();
                     }
                     else {
                         logger.error('WhatsApp logged out. Please re-scan QR code.');
@@ -94,75 +117,84 @@ export class WhatsAppChannel {
                     return;
                 // Rate limit check
                 if (!inboundLimiter.check(this.id)) {
-                    await sock.sendMessage(sender, { text: "I'm receiving too many messages right now. Please wait a moment." }).catch(() => { });
+                    await sock
+                        .sendMessage(sender, {
+                        text: "I'm receiving too many messages right now. Please wait a moment.",
+                    })
+                        .catch(() => { });
                     return;
                 }
                 const text = msg.message.conversation ||
                     msg.message.extendedTextMessage?.text ||
                     msg.message.imageMessage?.caption ||
-                    msg.message.videoMessage?.caption || '';
-                // Download media (in parallel)
-                const waDownloadTasks = [];
-                if (msg.message.imageMessage) {
-                    waDownloadTasks.push(downloadMediaMessage(msg, 'buffer', {})
-                        .then((buffer) => {
-                        if (buffer && !isOversized(buffer.length)) {
-                            const filePath = saveMedia(buffer, 'jpg');
-                            return { type: 'image', mimeType: msg.message.imageMessage.mimetype || 'image/jpeg', filePath };
-                        }
-                        return null;
-                    })
-                        .catch(() => null));
-                }
-                if (msg.message.audioMessage) {
-                    waDownloadTasks.push(downloadMediaMessage(msg, 'buffer', {})
-                        .then((buffer) => {
-                        if (buffer && !isOversized(buffer.length)) {
-                            const ext = msg.message.audioMessage.ptt ? 'ogg' : 'mp3';
-                            const filePath = saveMedia(buffer, ext);
+                    msg.message.videoMessage?.caption ||
+                    '';
+                const descriptors = [
+                    {
+                        key: 'imageMessage',
+                        build: (m, buf) => ({
+                            type: 'image',
+                            mimeType: m.imageMessage.mimetype || 'image/jpeg',
+                            filePath: saveMedia(buf, 'jpg'),
+                        }),
+                    },
+                    {
+                        key: 'audioMessage',
+                        build: (m, buf) => {
+                            const ext = m.audioMessage.ptt ? 'ogg' : 'mp3';
                             return {
-                                type: (msg.message.audioMessage.ptt ? 'voice' : 'audio'),
-                                mimeType: msg.message.audioMessage.mimetype || 'audio/ogg',
-                                filePath,
-                                duration: msg.message.audioMessage.seconds ?? undefined,
+                                type: m.audioMessage.ptt ? 'voice' : 'audio',
+                                mimeType: m.audioMessage.mimetype || 'audio/ogg',
+                                filePath: saveMedia(buf, ext),
+                                duration: m.audioMessage.seconds ?? undefined,
                             };
-                        }
-                        return null;
-                    })
-                        .catch(() => null));
-                }
-                if (msg.message.documentMessage) {
+                        },
+                    },
+                    {
+                        key: 'documentMessage',
+                        build: (m, buf) => {
+                            const ext = m.documentMessage.fileName?.split('.').pop() || 'bin';
+                            return {
+                                type: 'document',
+                                mimeType: m.documentMessage.mimetype || 'application/octet-stream',
+                                filePath: saveMedia(buf, ext, m.documentMessage.fileName ?? undefined),
+                                fileName: m.documentMessage.fileName ?? undefined,
+                            };
+                        },
+                    },
+                    {
+                        key: 'videoMessage',
+                        build: (m, buf) => ({
+                            type: 'video',
+                            mimeType: m.videoMessage.mimetype || 'video/mp4',
+                            filePath: saveMedia(buf, 'mp4'),
+                            duration: m.videoMessage.seconds ?? undefined,
+                        }),
+                    },
+                ];
+                const waDownloadTasks = [];
+                for (const d of descriptors) {
+                    if (!msg.message[d.key])
+                        continue;
                     waDownloadTasks.push(downloadMediaMessage(msg, 'buffer', {})
                         .then((buffer) => {
-                        if (buffer && !isOversized(buffer.length)) {
-                            const ext = msg.message.documentMessage.fileName?.split('.').pop() || 'bin';
-                            const filePath = saveMedia(buffer, ext, msg.message.documentMessage.fileName ?? undefined);
-                            return { type: 'document', mimeType: msg.message.documentMessage.mimetype || 'application/octet-stream', filePath, fileName: msg.message.documentMessage.fileName ?? undefined };
+                        if (!buffer || isOversized(buffer.length))
+                            return null;
+                        try {
+                            return d.build(msg.message, buffer);
                         }
-                        return null;
-                    })
-                        .catch(() => null));
-                }
-                if (msg.message.videoMessage) {
-                    waDownloadTasks.push(downloadMediaMessage(msg, 'buffer', {})
-                        .then((buffer) => {
-                        if (buffer && !isOversized(buffer.length)) {
-                            const filePath = saveMedia(buffer, 'mp4');
-                            return { type: 'video', mimeType: msg.message.videoMessage.mimetype || 'video/mp4', filePath, duration: msg.message.videoMessage.seconds ?? undefined };
+                        catch {
+                            return null;
                         }
-                        return null;
                     })
                         .catch(() => null));
                 }
                 const waResults = await Promise.allSettled(waDownloadTasks);
                 const media = waResults
                     .filter((r) => r.status === 'fulfilled' && r.value !== null)
-                    .map(r => r.value);
+                    .map((r) => r.value);
                 // Transcribe voice messages if STT is configured
-                if (this.sttProvider) {
-                    const { transcribeVoiceMessages } = await import('../voice/index.js');
-                    this.sttWarmedUp = await transcribeVoiceMessages(media, this.sttProvider, 'whatsapp', this.sttWarmedUp);
-                }
+                await this.voice.transcribe(media);
                 if (!text && media.length === 0)
                     return;
                 try {
@@ -173,7 +205,7 @@ export class WhatsAppChannel {
                         const cmdResult = await handleSharedCommand({
                             userId: waUserId,
                             text,
-                            isAdmin: this.allowedNumbers.size > 0 && waUserId === [...this.allowedNumbers][0],
+                            isAdmin: isChannelAdmin(this.allowedNumbers, waUserId, this.ctx.config.whatsapp?.adminNumber),
                             channelId: 'whatsapp',
                         }, this.ctx.tabManager);
                         if (cmdResult.handled) {
@@ -190,7 +222,7 @@ export class WhatsAppChannel {
                         channelId: 'whatsapp',
                         tabManager: this.ctx.tabManager,
                         voiceReplyMode: this.ctx.config.voice?.replyMode,
-                        ttsProvider: this.ttsProvider,
+                        ttsProvider: this.voice.tts,
                         userId: waUserId,
                         sendProgress: (msg) => {
                             sock.sendMessage(sender, { text: msg }).catch(() => { });
@@ -202,7 +234,11 @@ export class WhatsAppChannel {
                         return;
                     // Send voice reply if TTS generated audio
                     if (pipelineResult.audioPath) {
-                        await sock.sendMessage(sender, { audio: { url: pipelineResult.audioPath }, mimetype: 'audio/ogg; codecs=opus', ptt: true });
+                        await sock.sendMessage(sender, {
+                            audio: { url: pipelineResult.audioPath },
+                            mimetype: 'audio/ogg; codecs=opus',
+                            ptt: true,
+                        });
                         if (pipelineResult.voiceOnly)
                             return;
                     }
@@ -210,7 +246,11 @@ export class WhatsAppChannel {
                 }
                 catch (err) {
                     logger.error('WhatsApp message handler error:', err);
-                    await sock.sendMessage(sender, { text: 'Something went wrong processing your message. Check daemon logs for details.' }).catch(() => { });
+                    await sock
+                        .sendMessage(sender, {
+                        text: 'Something went wrong processing your message. Check daemon logs for details.',
+                    })
+                        .catch((sendErr) => logger.error('WhatsApp: failed to send fallback error message:', sendErr));
                 }
             });
         }
@@ -231,10 +271,12 @@ export class WhatsAppChannel {
         const sock = this.sock;
         if (!sock)
             return;
-        const chunks = chunkText(text, WHATSAPP_MAX_LENGTH);
-        for (const chunk of chunks) {
-            await retryWithBackoff(() => sock.sendMessage(peerId, { text: chunk }), [1000, 5000, 15000], 'whatsapp-send');
-        }
+        await sendChunkedResponse({
+            text,
+            maxLength: WHATSAPP_MAX_LENGTH,
+            retryLabel: 'whatsapp-send',
+            sendChunk: (chunk) => sock.sendMessage(peerId, { text: chunk }),
+        });
     }
     async sendNotification(message, _urgent) {
         const sock = this.sock;
@@ -256,21 +298,20 @@ export class WhatsAppChannel {
         const status = active ? 'composing' : 'paused';
         await sock.sendPresenceUpdate(status, peerId).catch(() => { });
     }
-    onMessage(_handler) {
-        // Messages are handled directly in start()
-    }
     // ─── Private ───
     async sendResponse(jid, text, tabName) {
-        const prefix = tabName && tabName !== 'default' ? `[${tabName}] ` : '';
-        const chunks = chunkText(prefix + text, WHATSAPP_MAX_LENGTH);
         const sock = this.sock;
-        for (const chunk of chunks) {
-            try {
-                await retryWithBackoff(() => sock.sendMessage(jid, { text: chunk }), [1000, 5000, 15000], 'whatsapp-send');
-            }
-            catch (err) {
-                logger.error(`WhatsApp delivery failed for ${jid}:`, err);
-            }
+        try {
+            await sendChunkedResponse({
+                text,
+                tabName,
+                maxLength: WHATSAPP_MAX_LENGTH,
+                retryLabel: 'whatsapp-send',
+                sendChunk: (chunk) => sock.sendMessage(jid, { text: chunk }),
+            });
+        }
+        catch (err) {
+            logger.error(`WhatsApp delivery failed for ${jid}:`, err);
         }
     }
     isAllowed(jid) {

package/dist/cli/capabilities.js

@@ -1,15 +1,15 @@
 import readline from 'node:readline';
 function ask(rl, question, defaultValue) {
     const prompt = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
-    return new Promise(r => rl.question(prompt, a => r(a.trim() || defaultValue || '')));
+    return new Promise((r) => rl.question(prompt, (a) => r(a.trim() || defaultValue || '')));
 }
 export async function enableCapability(packId) {
     const { getAvailablePacks, isEnabled, enablePack } = await import('../capabilities/index.js');
     const packs = getAvailablePacks();
-    const pack = packs.find(p => p.id === packId);
+    const pack = packs.find((p) => p.id === packId);
     if (!pack) {
         console.log(`Unknown capability: "${packId}"`);
-        console.log('Available: ' + packs.map(p => p.id).join(', '));
+        console.log('Available: ' + packs.map((p) => p.id).join(', '));
         return;
     }
     if (isEnabled(packId)) {
@@ -46,7 +46,7 @@ export async function listCapabilities() {
         web: 'Web',
     };
     for (const category of categories) {
-        const categoryPacks = packs.filter(p => p.category === category);
+        const categoryPacks = packs.filter((p) => p.category === category);
         if (categoryPacks.length === 0)
             continue;
         console.log(`  ${categoryNames[category]}:`);