squidclaw 0.5.2 → 0.5.3

package/lib/channels/hub.js

@@ -22,6 +22,20 @@ export class ChannelHub {
       return;
     }
 
+    // Allowlist check
+    const allowFrom = agent.allowFrom || ['*'];
+    if (!allowFrom.includes('*')) {
+      const senderNum = contactId.replace('@s.whatsapp.net', '').replace(/[^0-9]/g, '');
+      const allowed = allowFrom.some(n => {
+        const clean = n.replace(/[^0-9]/g, '');
+        return senderNum.endsWith(clean) || clean.endsWith(senderNum);
+      });
+      if (!allowed) {
+        logger.info('hub', 'Message from ' + contactId + ' blocked (not in allowlist)');
+        return;
+      }
+    }
+
     // Skip group messages unless mentioned (for now)
     if (metadata.isGroup) {
       // TODO: implement group mention detection

package/lib/cli/setup.js

@@ -176,9 +176,10 @@ export async function setup() {
   if (p.isCancel(connectWA)) return p.cancel('Setup cancelled');
 
   let waConnected = false;
+  let waPhone = null;
 
   if (connectWA === 'pair') {
-    const waPhone = await p.text({
+    waPhone = await p.text({
       message: 'WhatsApp phone number (with country code):',
       placeholder: '+966 5XX XXX XXXX',
       validate: (v) => v.replace(/[^0-9+]/g, '').length < 8 ? 'Enter a valid phone number' : undefined,
@@ -186,6 +187,7 @@ export async function setup() {
     if (p.isCancel(waPhone)) return p.cancel('Setup cancelled');
 
     const cleanPhone = waPhone.replace(/[^0-9]/g, '');
+    waPhone = cleanPhone;
     manifest.whatsappNumber = cleanPhone;
 
     // Actually connect WhatsApp NOW
@@ -215,6 +217,50 @@ export async function setup() {
     config.channels.whatsapp.enabled = true;
   }
 
+  // Ask for allowlist (who can chat with this agent?)
+  if (connectWA !== 'skip') {
+    const allowMode = await p.select({
+      message: 'Who can message this agent on WhatsApp?',
+      options: [
+        { value: 'owner', label: '🔒 Only me', hint: 'recommended for testing' },
+        { value: 'list', label: '📋 Specific numbers (allowlist)' },
+        { value: 'all', label: '🌍 Everyone', hint: 'public agent' },
+      ],
+    });
+    if (p.isCancel(allowMode)) return p.cancel('Setup cancelled');
+
+    if (allowMode === 'owner' && waPhone) {
+      config.channels.whatsapp.allowFrom = [waPhone];
+      manifest.allowFrom = [waPhone];
+      console.log(chalk.gray('  Only ' + waPhone + ' can chat with ' + agentName));
+    } else if (allowMode === 'owner' && !waPhone) {
+      const ownerPhone = await p.text({
+        message: 'Your phone number (with country code):',
+        placeholder: '+966 5XX XXX XXXX',
+        validate: (v) => v.replace(/[^0-9+]/g, '').length < 8 ? 'Enter a valid number' : undefined,
+      });
+      if (!p.isCancel(ownerPhone)) {
+        const clean = ownerPhone.replace(/[^0-9]/g, '');
+        config.channels.whatsapp.allowFrom = [clean];
+        manifest.allowFrom = [clean];
+      }
+    } else if (allowMode === 'list') {
+      const numbers = await p.text({
+        message: 'Allowed numbers (comma separated):',
+        placeholder: '+966501234567, +966509876543',
+        validate: (v) => v.length < 5 ? 'Enter at least one number' : undefined,
+      });
+      if (!p.isCancel(numbers)) {
+        const list = numbers.split(',').map(n => n.replace(/[^0-9]/g, '').trim()).filter(Boolean);
+        config.channels.whatsapp.allowFrom = list;
+        manifest.allowFrom = list;
+      }
+    } else {
+      config.channels.whatsapp.allowFrom = ['*'];
+      manifest.allowFrom = ['*'];
+    }
+  }
+
   // ═══ Step 4: Telegram ═══
   p.note('Step 4 of 4: Telegram', '✈️');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squidclaw",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "\ud83e\udd91 AI agent platform \u2014 human-like agents for WhatsApp, Telegram & more",
   "main": "lib/engine.js",
   "bin": {