fix: suppress only recent whatsapp group echoes (#53624) (thanks @w-sss)

steipete · steipete · commit 4e7638db9d51 · 2026-03-24T10:09:16.000-07:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -30,6 +30,7 @@ Docs: https://docs.openclaw.ai
 - Telegram/forum topics: recover `#General` topic `1` routing when Telegram omits forum metadata, including native commands, interactive callbacks, inbound message context, and fallback error replies. (#53699) thanks @huntharo
 - Discord/config types: add missing `autoArchiveDuration` to `DiscordGuildChannelConfig` so TypeScript config definitions match the existing schema and runtime support. (#43427) Thanks @davidguttman.
 - Feishu/startup: treat unresolved `SecretRef` app credentials as not configured during account resolution so CLI startup and read-only Feishu config surfaces stop crashing before runtime-backed secret resolution is available. (#53675) Thanks @hpt.
+- WhatsApp/groups: track recent gateway-sent message IDs and suppress only matching group echoes, preserving owner `/status`, `/new`, and `/activation` commands from linked-account `fromMe` traffic. (#53624) Thanks @w-sss.
 
 ## 2026.3.23
 
diff --git a/extensions/whatsapp/src/inbound/access-control.test.ts b/extensions/whatsapp/src/inbound/access-control.test.ts
@@ -162,68 +162,3 @@ describe("WhatsApp dmPolicy precedence", () => {
     expect(sendMessageMock).not.toHaveBeenCalled();
   });
 });
-
-describe("WhatsApp group fromMe filtering", () => {
-  beforeEach(async () => {
-    vi.resetModules();
-    ({ checkInboundAccessControl } = await import("./access-control.js"));
-  });
-
-  it("blocks fromMe messages in groups to prevent infinite loops (#53386)", async () => {
-    setAccessControlTestConfig({
-      channels: {
-        whatsapp: {
-          accounts: {
-            default: {
-              groupPolicy: "open",
-            },
-          },
-        },
-      },
-    });
-
-    const result = await checkInboundAccessControl({
-      accountId: "default",
-      from: "1234567890@g.us",
-      selfE164: "+15550009999",
-      senderE164: "+15550009999",
-      group: true,
-      pushName: "Owner",
-      isFromMe: true,
-      sock: { sendMessage: sendMessageMock },
-      remoteJid: "1234567890@g.us",
-    });
-
-    expect(result.allowed).toBe(false);
-    expect(result.shouldMarkRead).toBe(false);
-  });
-
-  it("allows fromMe=false messages in groups", async () => {
-    setAccessControlTestConfig({
-      channels: {
-        whatsapp: {
-          accounts: {
-            default: {
-              groupPolicy: "open",
-            },
-          },
-        },
-      },
-    });
-
-    const result = await checkInboundAccessControl({
-      accountId: "default",
-      from: "1234567890@g.us",
-      selfE164: "+15550009999",
-      senderE164: "+15550001111",
-      group: true,
-      pushName: "Other User",
-      isFromMe: false,
-      sock: { sendMessage: sendMessageMock },
-      remoteJid: "1234567890@g.us",
-    });
-
-    expect(result.allowed).toBe(true);
-    expect(result.shouldMarkRead).toBe(true);
-  });
-});
diff --git a/extensions/whatsapp/src/inbound/access-control.ts b/extensions/whatsapp/src/inbound/access-control.ts
@@ -83,19 +83,6 @@ export async function checkInboundAccessControl(params: {
     typeof params.messageTimestampMs === "number" &&
     params.messageTimestampMs < params.connectedAtMs - pairingGraceMs;
 
-  // Filter fromMe messages in groups to prevent infinite loops
-  // When an agent sends a message to a group, WhatsApp echoes it back.
-  // Without this filter, the agent would respond to its own message.
-  if (params.group && params.isFromMe) {
-    logVerbose("Skipping fromMe group message (prevents infinite loop)");
-    return {
-      allowed: false,
-      shouldMarkRead: false,
-      isSelfChat,
-      resolvedAccountId: account.accountId,
-    };
-  }
-
   // Group policy filtering:
   // - "open": groups bypass allowFrom, only mention-gating applies
   // - "disabled": block all group messages entirely
diff --git a/extensions/whatsapp/src/inbound/dedupe.ts b/extensions/whatsapp/src/inbound/dedupe.ts
@@ -2,16 +2,61 @@ import { createDedupeCache } from "openclaw/plugin-sdk/infra-runtime";
 
 const RECENT_WEB_MESSAGE_TTL_MS = 20 * 60_000;
 const RECENT_WEB_MESSAGE_MAX = 5000;
+const RECENT_OUTBOUND_MESSAGE_TTL_MS = 20 * 60_000;
+const RECENT_OUTBOUND_MESSAGE_MAX = 5000;
 
 const recentInboundMessages = createDedupeCache({
   ttlMs: RECENT_WEB_MESSAGE_TTL_MS,
   maxSize: RECENT_WEB_MESSAGE_MAX,
 });
+const recentOutboundMessages = createDedupeCache({
+  ttlMs: RECENT_OUTBOUND_MESSAGE_TTL_MS,
+  maxSize: RECENT_OUTBOUND_MESSAGE_MAX,
+});
+
+function buildMessageKey(params: {
+  accountId: string;
+  remoteJid: string;
+  messageId: string;
+}): string | null {
+  const accountId = params.accountId.trim();
+  const remoteJid = params.remoteJid.trim();
+  const messageId = params.messageId.trim();
+  if (!accountId || !remoteJid || !messageId || messageId === "unknown") {
+    return null;
+  }
+  return `${accountId}:${remoteJid}:${messageId}`;
+}
 
 export function resetWebInboundDedupe(): void {
   recentInboundMessages.clear();
+  recentOutboundMessages.clear();
 }
 
 export function isRecentInboundMessage(key: string): boolean {
   return recentInboundMessages.check(key);
 }
+
+export function rememberRecentOutboundMessage(params: {
+  accountId: string;
+  remoteJid: string;
+  messageId: string;
+}): void {
+  const key = buildMessageKey(params);
+  if (!key) {
+    return;
+  }
+  recentOutboundMessages.check(key);
+}
+
+export function isRecentOutboundMessage(params: {
+  accountId: string;
+  remoteJid: string;
+  messageId: string;
+}): boolean {
+  const key = buildMessageKey(params);
+  if (!key) {
+    return false;
+  }
+  return recentOutboundMessages.peek(key);
+}
diff --git a/extensions/whatsapp/src/inbound/monitor.ts b/extensions/whatsapp/src/inbound/monitor.ts
@@ -9,7 +9,11 @@ import { getChildLogger } from "openclaw/plugin-sdk/text-runtime";
 import { jidToE164, resolveJidToE164 } from "openclaw/plugin-sdk/text-runtime";
 import { createWaSocket, getStatusCode, waitForWaConnection } from "../session.js";
 import { checkInboundAccessControl } from "./access-control.js";
-import { isRecentInboundMessage } from "./dedupe.js";
+import {
+  isRecentInboundMessage,
+  isRecentOutboundMessage,
+  rememberRecentOutboundMessage,
+} from "./dedupe.js";
 import {
   describeReplyContext,
   extractLocationData,
@@ -128,6 +132,27 @@ export async function monitorWebInbox(options: {
   const resolveInboundJid = async (jid: string | null | undefined): Promise<string | null> =>
     resolveJidToE164(jid, { authDir: options.authDir, lidLookup });
 
+  const rememberOutboundMessage = (remoteJid: string, result: unknown) => {
+    const messageId =
+      typeof result === "object" && result && "key" in result
+        ? String((result as { key?: { id?: string } }).key?.id ?? "")
+        : "";
+    if (!messageId) {
+      return;
+    }
+    rememberRecentOutboundMessage({
+      accountId: options.accountId,
+      remoteJid,
+      messageId,
+    });
+  };
+
+  const sendTrackedMessage = async (jid: string, content: AnyMessageContent) => {
+    const result = await sock.sendMessage(jid, content);
+    rememberOutboundMessage(jid, result);
+    return result;
+  };
+
   const getGroupMeta = async (jid: string) => {
     const cached = groupMetaCache.get(jid);
     if (cached && cached.expires > Date.now()) {
@@ -183,6 +208,19 @@ export async function monitorWebInbox(options: {
     }
 
     const group = isGroupJid(remoteJid);
+    if (
+      group &&
+      Boolean(msg.key?.fromMe) &&
+      id &&
+      isRecentOutboundMessage({
+        accountId: options.accountId,
+        remoteJid,
+        messageId: id,
+      })
+    ) {
+      logVerbose(`Skipping recent outbound WhatsApp group echo ${id} for ${remoteJid}`);
+      return null;
+    }
     if (id) {
       const dedupeKey = `${options.accountId}:${remoteJid}:${id}`;
       if (isRecentInboundMessage(dedupeKey)) {
@@ -221,7 +259,7 @@ export async function monitorWebInbox(options: {
       isFromMe: Boolean(msg.key?.fromMe),
       messageTimestampMs,
       connectedAtMs,
-      sock: { sendMessage: (jid, content) => sock.sendMessage(jid, content) },
+      sock: { sendMessage: (jid, content) => sendTrackedMessage(jid, content) },
       remoteJid,
     });
     if (!access.allowed) {
@@ -334,10 +372,10 @@ export async function monitorWebInbox(options: {
       }
     };
     const reply = async (text: string) => {
-      await sock.sendMessage(chatJid, { text });
+      await sendTrackedMessage(chatJid, { text });
     };
     const sendMedia = async (payload: AnyMessageContent) => {
-      await sock.sendMessage(chatJid, payload);
+      await sendTrackedMessage(chatJid, payload);
     };
     const timestamp = inbound.messageTimestampMs;
     const mentionedJids = extractMentionedJids(msg.message as proto.IMessage | undefined);
@@ -474,7 +512,7 @@ export async function monitorWebInbox(options: {
 
   const sendApi = createWebSendApi({
     sock: {
-      sendMessage: (jid: string, content: AnyMessageContent) => sock.sendMessage(jid, content),
+      sendMessage: (jid: string, content: AnyMessageContent) => sendTrackedMessage(jid, content),
       sendPresenceUpdate: (presence, jid?: string) => sock.sendPresenceUpdate(presence, jid),
     },
     defaultAccountId: options.accountId,
diff --git a/extensions/whatsapp/src/monitor-inbox.allows-messages-from-senders-allowfrom-list.test.ts b/extensions/whatsapp/src/monitor-inbox.allows-messages-from-senders-allowfrom-list.test.ts
@@ -214,6 +214,90 @@ describe("web monitor inbox", () => {
     });
   });
 
+  it("allows owner fromMe group commands when they were not sent by the gateway", async () => {
+    mockLoadConfig.mockReturnValue({
+      channels: {
+        whatsapp: {
+          groupPolicy: "open",
+          allowFrom: ["+123"],
+        },
+      },
+      messages: DEFAULT_MESSAGES_CFG,
+    });
+
+    const { onMessage, listener, sock } = await openInboxMonitor();
+
+    sock.ev.emit("messages.upsert", {
+      type: "notify",
+      messages: [
+        {
+          key: {
+            id: "owner-group-1",
+            fromMe: true,
+            remoteJid: "120363@g.us",
+            participant: "123@s.whatsapp.net",
+          },
+          message: { conversation: "/status" },
+          messageTimestamp: nowSeconds(),
+          pushName: "Owner",
+        },
+      ],
+    });
+    await waitForMessageCalls(onMessage, 1);
+
+    expect(onMessage).toHaveBeenCalledWith(
+      expect.objectContaining({
+        body: "/status",
+        chatType: "group",
+        from: "120363@g.us",
+        fromMe: true,
+        senderE164: "+123",
+      }),
+    );
+
+    await listener.close();
+  });
+
+  it("filters group fromMe echoes only when the gateway sent the matching message id", async () => {
+    mockLoadConfig.mockReturnValue({
+      channels: {
+        whatsapp: {
+          groupPolicy: "open",
+          allowFrom: ["+123"],
+        },
+      },
+      messages: DEFAULT_MESSAGES_CFG,
+    });
+
+    const onMessage = vi.fn();
+    const { listener, sock } = await startInboxMonitor(onMessage);
+
+    sock.sendMessage.mockResolvedValueOnce({ key: { id: "bot-group-echo-1" } });
+    await listener.sendMessage("120363@g.us", "gateway echo candidate");
+
+    sock.ev.emit("messages.upsert", {
+      type: "notify",
+      messages: [
+        {
+          key: {
+            id: "bot-group-echo-1",
+            fromMe: true,
+            remoteJid: "120363@g.us",
+            participant: "123@s.whatsapp.net",
+          },
+          message: { conversation: "gateway echo candidate" },
+          messageTimestamp: nowSeconds(),
+          pushName: "Owner",
+        },
+      ],
+    });
+    await settleInboundWork();
+
+    expect(onMessage).not.toHaveBeenCalled();
+
+    await listener.close();
+  });
+
   it("handles append messages by marking them read but skipping auto-reply", async () => {
     const { onMessage, listener, sock } = await openInboxMonitor();
     const staleTs = Math.floor(Date.now() / 1000) - 300;
