Gate WhatsApp responsiveness lint exec probes

giodl73-repo · giodl73-repo · commit 39f003931ff8 · 2026-07-03T11:33:08.000-07:00
diff --git a/src/commands/doctor-whatsapp-responsiveness.test.ts b/src/commands/doctor-whatsapp-responsiveness.test.ts
@@ -43,11 +43,16 @@ describe("doctor WhatsApp responsiveness", () => {
       ].join("\n"),
     });
 
-    expect(listLocalTuiProcesses()).toEqual([
-      { pid: 101, command: "openclaw-tui" },
-      { pid: 104, command: "openclaw tui --local" },
-      { pid: 105, command: "/usr/bin/openclaw chat" },
-    ]);
+    if (process.platform === "win32") {
+      expect(listLocalTuiProcesses()).toEqual([]);
+      expect(spawnSyncMock).not.toHaveBeenCalled();
+    } else {
+      expect(listLocalTuiProcesses()).toEqual([
+        { pid: 101, command: "openclaw-tui" },
+        { pid: 104, command: "openclaw tui --local" },
+        { pid: 105, command: "/usr/bin/openclaw chat" },
+      ]);
+    }
   });
 
   it("terminates stale local TUI processes with a kill fallback", async () => {
diff --git a/src/flows/doctor-health-contributions.test.ts b/src/flows/doctor-health-contributions.test.ts
@@ -101,7 +101,7 @@ const mocks = vi.hoisted(() => ({
   collectDiskSpaceHealthFindings: vi.fn((): readonly HealthFinding[] => []),
   collectHeartbeatTemplateHealthFindings: vi.fn(async () => [] as unknown[]),
   maybeRepairHeartbeatTemplate: vi.fn().mockResolvedValue(undefined),
-  collectWhatsappResponsivenessHealthFindings: vi.fn(() => []),
+  collectWhatsappResponsivenessHealthFindings: vi.fn((): readonly HealthFinding[] => []),
   noteWhatsappResponsivenessHealth: vi.fn().mockResolvedValue(undefined),
   collectDevicePairingHealthFindings: vi.fn(async () => []),
   scanConfiguredChannelPluginBlockers: vi.fn(
@@ -1755,7 +1755,6 @@ describe("doctor health contributions", () => {
         requirement: "local-tui-event-loop-pressure",
       },
     ]);
-    mocks.callGateway.mockResolvedValueOnce(status);
 
     await expect(
       runDoctorLintChecks(ctx, { checks, onlyIds: ["core/doctor/whatsapp-responsiveness"] }),
@@ -1770,6 +1769,7 @@ describe("doctor health contributions", () => {
       params: { includeChannelSummary: false },
       timeoutMs: 3000,
       config: ctx.cfg,
+      deviceIdentity: null,
     });
     expect(mocks.collectWhatsappResponsivenessHealthFindings).toHaveBeenCalledWith({
       cfg: ctx.cfg,
@@ -1799,6 +1799,36 @@ describe("doctor health contributions", () => {
     });
   });
 
+  it("skips WhatsApp responsiveness Gateway status probes for exec SecretRefs without allow-exec", async () => {
+    const contributionChecks = await resolveDoctorContributionHealthChecks();
+    const whatsappCheck = contributionChecks.find(
+      (check) => check.id === "core/doctor/whatsapp-responsiveness",
+    );
+    expect(whatsappCheck).toBeDefined();
+    mocks.gatewaySecretInputPathCanWin.mockReturnValue(true);
+    mocks.readGatewaySecretInputValue.mockReturnValue("exec-token");
+
+    const ctx = {
+      cfg: { channels: { whatsapp: { enabled: true } } },
+      mode: "lint",
+      runtime: { log: vi.fn(), error: vi.fn(), exit: vi.fn() },
+    } as const;
+    const checks = [whatsappCheck!];
+
+    await expect(
+      runDoctorLintChecks(ctx, { checks, onlyIds: ["core/doctor/whatsapp-responsiveness"] }),
+    ).resolves.toMatchObject({
+      checksRun: 1,
+      checksSkipped: 0,
+      findings: [],
+    });
+    expect(mocks.callGateway).not.toHaveBeenCalled();
+    expect(mocks.collectWhatsappResponsivenessHealthFindings).toHaveBeenCalledWith({
+      cfg: ctx.cfg,
+      status: undefined,
+    });
+  });
+
   it("keeps device pairing opt-in for default lint selection", async () => {
     const contributionChecks = await resolveDoctorContributionHealthChecks();
     const devicePairingCheck = contributionChecks.find(
diff --git a/src/flows/doctor-health-contributions.ts b/src/flows/doctor-health-contributions.ts
@@ -980,7 +980,7 @@ async function runSystemdLingerHealth(ctx: DoctorHealthFlowContext): Promise<voi
 }
 
 async function hasActiveGatewayExecCredential(
-  ctx: DoctorHealthFlowContext,
+  ctx: Pick<DoctorHealthFlowContext, "cfg">,
   mode: DoctorFlowMode = resolveDoctorMode(ctx.cfg),
 ): Promise<boolean> {
   const { resolveSecretInputRef } = await loadSecretTypesModule();
@@ -1921,15 +1921,24 @@ export function resolveDoctorHealthContributions(): DoctorHealthContribution[] {
           "WhatsApp responsiveness pressure from degraded Gateway and local TUI clients.",
         defaultEnabled: false,
         async detect(ctx) {
-          const { callGateway } = await import("../gateway/call.js");
           const { collectWhatsappResponsivenessHealthFindings } =
             await import("../commands/doctor-whatsapp-responsiveness.js");
-          const status = await callGateway<import("../commands/status.types.js").StatusSummary>({
-            method: "status",
-            params: { includeChannelSummary: false },
-            timeoutMs: 3000,
-            config: ctx.cfg,
-          }).catch(() => undefined);
+          let status: import("../commands/status.types.js").StatusSummary | undefined;
+          if (
+            !(
+              (await hasActiveGatewayExecCredential({ cfg: ctx.cfg })) &&
+              ctx.allowExecSecretRefs !== true
+            )
+          ) {
+            const { callGateway } = await import("../gateway/call.js");
+            status = await callGateway<import("../commands/status.types.js").StatusSummary>({
+              method: "status",
+              params: { includeChannelSummary: false },
+              timeoutMs: 3000,
+              config: ctx.cfg,
+              deviceIdentity: null,
+            }).catch(() => undefined);
+          }
           return collectWhatsappResponsivenessHealthFindings({ cfg: ctx.cfg, status });
         },
       },
