fix(whatsapp): isolate multi-account inbound state and align shared defaults by mcaxtr · Pull Request #65700 · openclaw/openclaw

mcaxtr · 2026-04-13T04:04:57Z

Summary

Problem: WhatsApp multi-account inbound behavior was split across several partially independent paths: ingress auth, command auth, group gating, group activation/session state, setup writes, and schema/runtime compat. Named-account groups also moved to scoped session keys while legacy/default-shared behavior still existed in stores and config.
Why it matters: this created real regressions and contract drift: cross-account group-state bleed, lost legacy activation, mismatched setup/schema/runtime behavior around accounts.default, debounce fallback breakage, self-chat/mention-gating inconsistencies, and confusing remediation/config paths.
What changed: this PR centralizes WhatsApp inbound policy resolution, scopes named-account group session state, preserves legacy activation state during the migration, wires channels.whatsapp.accounts.default through runtime/setup/schema/helpers, and fixes the follow-on regressions needed so those surfaces agree.
What did NOT change (scope boundary): no new end-user WhatsApp feature, no new login/onboarding model, and no broad plugin-architecture rewrite beyond the minimal helper/runtime alignment needed for WhatsApp.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes: N/A
Related: N/A
This PR fixes a bug or regression

Root Cause (if applicable)

Root cause: WhatsApp effective inbound policy and session identity were being derived in multiple places with different precedence rules. At the same time, the branch introduced account-scoped group sessions and accounts.default shared defaults, but not every downstream surface was updated to honor that new contract consistently.
Missing detection / guardrail: we did not have focused regression coverage tying together named-account routing, activation migration, accounts.default inheritance, setup writes, schema validation, and monitor/runtime behavior.
Contributing context (if known): legacy unsuffixed group session state, mixed-case account ids, default-account compatibility paths, and global-vs-account debounce fallback all interacted with the new multi-account model.

Regression Test Plan (if applicable)

Coverage level that should have caught this:
- Unit test
- Seam / integration test
- End-to-end test
- Existing coverage already sufficient
Target test or file:
- extensions/whatsapp/src/inbound/access-control.test.ts
- extensions/whatsapp/src/group-session-key.test.ts
- extensions/whatsapp/src/auto-reply/monitor/group-activation.test.ts
- extensions/whatsapp/src/auto-reply/web-auto-reply-monitor.test.ts
- extensions/whatsapp/src/auto-reply.web-auto-reply.connection-and-logging.e2e.test.ts
- extensions/whatsapp/src/channel.setup.test.ts
- extensions/whatsapp/src/accounts.test.ts
- src/config/config.schema-regressions.test.ts
- src/config/io.compat.test.ts
- src/commands/doctor-legacy-config.migrations.test.ts
- src/channels/plugins/helpers.test.ts
- src/plugin-sdk/channel-config-helpers.test.ts
- src/auto-reply/reply/session.test.ts
Scenario the test should lock in: named-account WhatsApp inbound decisions stay account-scoped and consistent across auth, gating, activation, legacy migration, setup/config writes, and schema/runtime interpretation.
Why this is the smallest reliable guardrail: the regressions lived in WhatsApp’s plugin-local seams plus a few shared config/session helpers, so focused unit/seam coverage catches the real failures without needing a slow live-device lane.
Existing test that already covers this (if any): pre-existing monitor/inbox coverage still covers core ingress flows; this PR expands coverage for the newly introduced multi-account/default-account contract.
If no new test is added, why not: N/A

User-visible / Behavior Changes

Named WhatsApp accounts now keep group activation and related session-backed state isolated from the default account and from each other.
Legacy unsuffixed named-account group activation is preserved by backfilling into the new scoped session key path instead of silently falling back to mention-gated behavior.
channels.whatsapp.accounts.default now behaves as a real shared-default source across runtime, setup/finalize writes, and schema validation.
Group gating, command authorization, self-chat handling, ack behavior, and debounce fallback now agree with the same effective account-scoped policy.
Verbose WhatsApp inbound diagnostics needed for live scenario validation are restored on this branch.

Diagram (if applicable)

Before:
inbound message
  -> ingress auth uses one effective policy
  -> group gating / activation / setup / schema use partially different rules
  -> named-account groups may reuse shared or legacy state

After:
inbound message
  -> resolveWhatsAppInboundPolicy()
  -> shared effective account policy across auth/gating/command checks
  -> named-account group session key + legacy activation backfill
  -> setup/schema/runtime all read the same shared-default model

Security Impact (required)

New permissions/capabilities? (Yes/No) No
Secrets/tokens handling changed? (Yes/No) No
New/changed network calls? (Yes/No) No
Command/tool execution surface changed? (Yes/No) No
Data access scope changed? (Yes/No) No
If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

OS: Linux
Runtime/container: Node 22 + pnpm workspace
Model/provider: N/A
Integration/channel (if any): WhatsApp plugin
Relevant config (redacted): multi-account WhatsApp config with named accounts, shared group JID, allowFrom, groupAllowFrom, accounts.default, and legacy session-store entries

Steps

Configure WhatsApp with default + named accounts, including differing DM/group policies and shared-group traffic.
Exercise DM auth, group mention gating, owner commands, activation, legacy activation migration, broadcast routing, and debounce/ack behavior.
Verify runtime, setup, and schema all agree on the same effective account-scoped behavior.

Expected

Named-account group state is isolated.
Legacy activation survives the scoped-key migration.
accounts.default inheritance behaves consistently across runtime/setup/schema.
Group gating, command auth, and debounce/ack behavior use the same effective policy.

Actual

The targeted WhatsApp and shared-helper regression suites pass with the fixes in place, and the branch behavior aligns with the manual scenario matrix used during review.

Evidence

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

Verified scenarios: targeted automated coverage for ingress auth, group gating, legacy activation backfill, scoped group routing, setup writes, schema/runtime compat, debounce fallback, and shared helper paths.
Edge cases checked: mixed-case default-account keys, scoped entry without groupActivation, legacy activation-only entries, named-account debounce lookup, and groupAllowFrom: [] falling back to allowFrom.
What you did not verify: a fresh end-to-end live-device pass for the entire 22-scenario matrix inside CI.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

Backward compatible? (Yes/No) Yes
Config/env changes? (Yes/No) No
Migration needed? (Yes/No) No
If yes, exact upgrade steps: N/A

Risks and Mitigations

Risk: legacy session-store and mixed-case account-key compatibility paths are subtle and easy to regress when changing account/session resolution again.
- Mitigation: this PR adds focused regression coverage for legacy activation backfill, mixed-case default-account lookup, setup writes, and schema/runtime agreement.
Risk: accounts.default inheritance now matters across more surfaces, so future WhatsApp changes can accidentally update only runtime or only validation.
- Mitigation: the PR aligns setup, schema, compat, and helper paths now, and adds explicit tests for those agreement points.

greptile-apps · 2026-04-13T04:11:28Z

Greptile Summary

This PR centralizes WhatsApp inbound policy resolution into extensions/whatsapp/src/inbound-policy.ts and introduces account-scoped group session keys in extensions/whatsapp/src/group-session-key.ts, routing ingress auth, command auth, group gating/activation, and broadcast handling through a single canonical resolver to eliminate cross-account policy drift and shared group session state bleed. Legacy group activation records are backfilled into the new account-scoped key on first read with the old record left intentionally in place.

Confidence Score: 5/5

Safe to merge — logic is correct and well covered by the new focused regression tests

All findings are P2 style-level observations. The core fixes (canonical policy resolver, account-scoped session keys, async backfill) are implemented correctly: lastRoutePolicy remains 'session' for group routes after the key scoping (since the scoped key always differs from mainSessionKey), the broadcast path correctly re-scopes per-agent keys after buildBroadcastRouteKeys overwrites them, and the legacy backfill guard prevents double-writes. New tests directly lock in the cross-account isolation properties the PR fixes.

No files require special attention

_{Reviews (2): Last reviewed commit: "fix(whatsapp): address inbound policy re..." | Re-trigger Greptile}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 59aaf62459

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

mcaxtr · 2026-04-13T04:29:01Z

Follow-up triage on the bot comments and the failing CI is done.

What changed in the follow-up:

Fixed the real regression that was breaking CI by removing the new Madge import cycle. extensions/whatsapp/src/inbound-policy.ts now depends on extensions/whatsapp/src/inbound/types.ts instead of the auto-reply/types path that closed the loop back through inbound.ts.
Fixed the actual migration risk in extensions/whatsapp/src/auto-reply/monitor/group-activation.ts: legacy named-account backfill now copies only groupActivation into the new scoped key instead of cloning the full legacy session object.
Tightened extensions/whatsapp/src/auto-reply/monitor/group-activation.test.ts so it proves unrelated legacy metadata is not migrated during that backfill.

What I reviewed but did not change:

shouldReadStorePairingApprovals being broader than its name suggests in extensions/whatsapp/src/inbound-policy.ts: this is not behaviorally wrong and did not contribute to the regressions or failing gates on this PR.
The selfE164 omission in the resolveConversationRequireMention() call path in extensions/whatsapp/src/auto-reply/monitor/group-activation.ts: there is no current behavior dependency or failing coverage tied to it.
Treating the legacy backfill write as best-effort instead of awaited: that is hardening, but not an observed regression from this PR.

Verification after the follow-up:

pnpm check
pnpm test extensions/whatsapp/src/auto-reply/monitor/group-activation.test.ts extensions/whatsapp/src/inbound/access-control.test.ts extensions/whatsapp/src/auto-reply/web-auto-reply-monitor.test.ts

I replied to every open review thread with the fix/triage rationale and resolved them.

@greptile review
@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2dd3176424

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba2be51a9c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 983adc2638

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 607026d7a2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74db285b80

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3991b88b8e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e5250a2237

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 03e68f573c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

aisle-research-bot · 2026-04-18T00:58:50Z

🔒 Aisle Security Analysis

We found 2 potential security issue(s) in this PR:

#	Severity	Title
1	🟡 Medium	Session-key collision across WhatsApp named accounts due to lossy accountId normalization in thread suffix
2	🟡 Medium	Cross-account group activation state leakage via legacy WhatsApp group session keys

1. 🟡 Session-key collision across WhatsApp named accounts due to lossy accountId normalization in thread suffix

Property	Value
Severity	Medium
CWE	CWE-639
Location	`extensions/whatsapp/src/group-session-key.ts:8-10`

Description

The new WhatsApp group session scoping appends a :thread: suffix derived from normalizeAccountId(accountId).

normalizeAccountId() canonicalizes account IDs by lowercasing and replacing any non [a-z0-9_-] characters with - (and trimming/shortening).
Different configured account IDs (e.g., "a:b" and "a-b", or "Sales Team" and "sales-team") can normalize to the same canonical value.
As a result, multiple distinct WhatsApp accounts can end up sharing the same group session key suffix and collide in the session store.
This can mix group activation state, history/flags, and routing context across accounts (cross-account state leakage) when named accounts are used.

Vulnerable code:

function resolveWhatsAppGroupAccountThreadId(accountId: string): string {
  return `whatsapp-account-${normalizeAccountId(accountId)}`;
}

This is particularly risky because account IDs are user-controlled configuration keys (Zod schema allows arbitrary strings as accounts record keys), and collisions are not prevented by config validation.

Recommendation

Avoid lossy normalization for values that define storage/routing boundaries.

Options:

Validate account IDs strictly at config load time and reject any IDs that are not already canonical and reject duplicates on canonical form.
Or encode the raw account ID into the thread id in a collision-resistant way (e.g., base64url), rather than normalizeAccountId().

Example (collision-resistant thread id):

function base64url(input: string) {
  return Buffer.from(input, "utf8").toString("base64")
    .replace(/\+/g, "-")
    .replace(/\//g, "_")
    .replace(/=+$/g, "");
}

function resolveWhatsAppGroupAccountThreadId(accountId: string): string {
  // keep delimiter-safe, collision-resistant
  return `whatsapp-account-${base64url(accountId.trim())}`;
}

If you keep normalizeAccountId(), add a config-time check such as:

ensure each account key matches /^[a-z0-9][a-z0-9_-]{0,63}$/i (or the desired policy)
ensure no two account keys normalize/canonicalize to the same value.

2. 🟡 Cross-account group activation state leakage via legacy WhatsApp group session keys

Property	Value
Severity	Medium
CWE	CWE-284
Location	`extensions/whatsapp/src/auto-reply/monitor/group-activation.ts:42-66`

Description

resolveGroupActivationFor falls back to a legacy (unscoped) group session key when determining groupActivation, and then backfills that value into the scoped per-account session key.

In multi-account WhatsApp setups, this can cause activation state from a different account (or from the former single-account/default setup) to be applied to another account that shares the same agentId + group but uses a different accountId.

Impact:

A legacy store entry (keyed without the :thread:whatsapp-account-<account> suffix) that contains groupActivation: "always" will be used for any named account in the same group.
This can bypass per-account expectations around mention gating (i.e., the bot processes all group messages instead of only mentions) and can lead to unintended processing/replies in groups for other accounts.
Because the code also persists/backfills the derived activation into the scoped key, the cross-account state becomes sticky.

Vulnerable logic:

const legacySessionKey = resolveWhatsAppLegacyGroupSessionKey({ sessionKey, accountId });
const legacyEntry = legacySessionKey ? store[legacySessionKey] : undefined;
...
const activation = scopedEntry?.groupActivation ?? legacyEntry?.groupActivation;
if (activation !== undefined && scopedEntry?.groupActivation === undefined) {
  await updateSessionStore(storePath, (nextStore) => {
    ...
    nextStore[sessionKey] = { ...nextScopedEntry, groupActivation: activation };
  });
}

Data-flow summary:

Source: legacyEntry?.groupActivation loaded from shared/unscoped store key (agent:*:whatsapp:group:<id>@g.us).
Sink: influences group gating (requireMention = activation !== "always") and is persisted into the scoped store entry via updateSessionStore.

If an attacker (or merely a user with sufficient command permissions) can cause a legacy activation value to be written for one account, it can inadvertently enable always-on processing for other accounts in the same group.

Recommendation

Do not apply legacy/unscoped groupActivation across accounts in multi-account setups.

Recommended fixes (pick one):

Gate legacy fallback to single-account configurations only (safest default):

const multiAccount = hasNamedWhatsAppAccounts(params.cfg);
const activation = scopedEntry?.groupActivation ?? (!multiAccount ? legacyEntry?.groupActivation : undefined);

If legacy migration is required, migrate only when you can prove the legacy entry belongs to the same account, e.g. by storing and verifying an accountId field in the legacy entry during migration.
Add an explicit config flag (off by default) to enable cross-account legacy backfill.

Also consider avoiding automatic persistence/backfill (updateSessionStore) unless the migration conditions are met, to prevent making accidental cross-account activation sticky.

Analyzed PR: #65700 at commit 61b6da9

_{Last updated on: 2026-04-18T04:35:34Z}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6152eb5cc7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5b421a6ae0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f5922e9d1c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99e97e162e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

…efaults (openclaw#65700) * refactor(whatsapp): centralize inbound policy resolution * fix(whatsapp): scope named-account group session keys * fix(whatsapp): preserve legacy group activation during scoped-key migration * fix(whatsapp): wire shared defaults through accounts.default * fix(whatsapp): align schema, helpers, and monitor behavior * fix(whatsapp): restore verbose inbound diagnostics * chore(config): refresh whatsapp changelog and baseline hashes

openclaw-barnacle Bot added channel: whatsapp-web Channel integration: whatsapp-web size: L maintainer Maintainer-authored PR labels Apr 13, 2026

greptile-apps Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/inbound-policy.ts

Comment thread extensions/whatsapp/src/auto-reply/monitor/group-activation.ts

chatgpt-codex-connector Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/auto-reply/monitor/group-activation.ts Outdated

Comment thread extensions/whatsapp/src/auto-reply/monitor/group-activation.ts

chatgpt-codex-connector Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/auto-reply/monitor/group-activation.ts Outdated

Comment thread extensions/whatsapp/src/auto-reply/monitor/group-gating.ts

openclaw-barnacle Bot added size: XL and removed size: L labels Apr 13, 2026

chatgpt-codex-connector Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/inbound-policy.ts Outdated

mcaxtr force-pushed the refactor/whatsapp-inbound-policy branch from ba2be51 to 983adc2 Compare April 16, 2026 02:15

chatgpt-codex-connector Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/auto-reply/monitor/process-message.ts

Comment thread extensions/whatsapp/src/group-session-key.ts

mcaxtr force-pushed the refactor/whatsapp-inbound-policy branch from 983adc2 to 605f876 Compare April 16, 2026 02:43

openclaw-barnacle Bot added docs Improvements or additions to documentation commands Command implementations labels Apr 16, 2026

chatgpt-codex-connector Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/account-config.ts

Comment thread src/plugin-sdk/channel-config-helpers.ts

chatgpt-codex-connector Bot reviewed Apr 17, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/auto-reply/monitor.ts Outdated

chatgpt-codex-connector Bot reviewed Apr 17, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/inbound-policy.ts Outdated

Comment thread extensions/whatsapp/src/auto-reply/monitor.ts

mcaxtr force-pushed the refactor/whatsapp-inbound-policy branch from 3991b88 to e5250a2 Compare April 18, 2026 00:10

chatgpt-codex-connector Bot reviewed Apr 18, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/inbound-policy.ts Outdated

Comment thread extensions/whatsapp/src/auto-reply/monitor.ts Outdated

chatgpt-codex-connector Bot reviewed Apr 18, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/auto-reply/monitor.ts

chatgpt-codex-connector Bot reviewed Apr 18, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/auto-reply/monitor/group-activation.ts Outdated

chatgpt-codex-connector Bot reviewed Apr 18, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/setup-finalize.ts Outdated

chatgpt-codex-connector Bot reviewed Apr 18, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/inbound-policy.ts Outdated

Comment thread src/config/zod-schema.providers-whatsapp.ts Outdated

mcaxtr changed the title ~~fix(whatsapp): unify inbound policy resolution~~ fix(whatsapp): isolate multi-account inbound state and align shared defaults Apr 18, 2026

chatgpt-codex-connector Bot reviewed Apr 18, 2026

View reviewed changes

Comment thread extensions/whatsapp/src/shared.ts Outdated

mcaxtr force-pushed the refactor/whatsapp-inbound-policy branch from 99e97e1 to 2755b57 Compare April 18, 2026 03:59

openclaw-barnacle Bot removed the docs Improvements or additions to documentation label Apr 18, 2026

clawsweeper Bot mentioned this pull request Apr 30, 2026

[feature] Add on-unauthorized hook event and suppress-pairing-reply config flag #68214

Closed

clawsweeper Bot mentioned this pull request May 3, 2026

feat(whatsapp): add poll, reaction, event, and RSVP message support #48570

Closed

11 tasks

This was referenced May 10, 2026

[Feature]: Batch WhatsApp messages by messageTimestamp instead of receive time #11703

Open

WhatsApp: add composing-aware inbound debounce extension #47542

Closed

This was referenced May 21, 2026

Add optional name/label field to group config entries #11487

Open

Feature: Auto-leave WhatsApp groups not in allowlist + group-join webhook #8495

Open

This was referenced Jun 21, 2026

fix(whatsapp): Add group admin privacy controls #69297

Open

fix: route WhatsApp group activation through session accessor #96530

Merged

fix(whatsapp): finish timeout-aware setup and status handling #67816

Open

clawsweeper Bot mentioned this pull request Jul 2, 2026

fix(whatsapp): restore malformed credentials from backup #99070

Merged

Uh oh!

Uh oh!

Conversation

mcaxtr commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Root Cause (if applicable)

Regression Test Plan (if applicable)

User-visible / Behavior Changes

Diagram (if applicable)

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Risks and Mitigations

Uh oh!

greptile-apps Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

mcaxtr commented Apr 13, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

mcaxtr commented Apr 13, 2026 •

edited

Loading

greptile-apps Bot commented Apr 13, 2026 •

edited

Loading

aisle-research-bot Bot commented Apr 18, 2026 •

edited

Loading