Skip to content

feat(qa): wire Crabline WhatsApp transport#95920

Merged
RomneyDa merged 1 commit into
mainfrom
codex/crabline-provider-env-wiring
Jun 29, 2026
Merged

feat(qa): wire Crabline WhatsApp transport#95920
RomneyDa merged 1 commit into
mainfrom
codex/crabline-provider-env-wiring

Conversation

@RomneyDa

@RomneyDa RomneyDa commented Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

What Problem This Solves

Keeps #95920 as the WhatsApp-only follow-up stacked on #97891. QA Lab can consume the published Crabline WhatsApp Baileys WebSocket server without Slack wiring or old runtime hook code in this PR.

Why This Change Was Made

Crabline 0.1.4 now publishes the WhatsApp WebSocket endpoint and returns OPENCLAW_WHATSAPP_WEB_SOCKET_URL from its OpenClaw smoke env binding. OpenClaw only needs the package bump and focused QA Lab contract coverage on top of the shared transport env forwarding from #97891.

User Impact

Maintainers can run Crabline-backed WhatsApp QA through the normal WhatsApp channel path without live WhatsApp credentials. Production WhatsApp behavior is unchanged unless QA explicitly supplies the WebSocket URL env.

Evidence

  • node scripts/run-vitest.mjs run --config test/vitest/vitest.extension-qa.config.ts qa-lab/src/crabline-transport.test.ts
  • pnpm tsgo:extensions:test

@RomneyDa
RomneyDa requested a review from a team as a code owner June 23, 2026 02:12
@openclaw-barnacle openclaw-barnacle Bot added channel: slack Channel integration: slack channel: whatsapp-web Channel integration: whatsapp-web extensions: qa-lab size: L maintainer Maintainer-authored PR labels Jun 23, 2026
@github-actions github-actions Bot added the dependencies-changed PR changes dependency-related files label Jun 23, 2026
@github-actions

github-actions Bot commented Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Dependency graph changes are blocked

OpenClaw does not accept dependency graph changes through PRs unless a repository admin or security explicitly authorizes the current head SHA. Dependency updates are generated internally by maintainers so external PRs cannot change the resolved graph.

Detected dependency graph changes:

  • pnpm-lock.yaml changed.
  • extensions/qa-lab/package.json changed devDependencies.

Auto-scrub was not attempted because this PR changes package manifest dependency graph fields:

  • extensions/qa-lab/package.json changed devDependencies.

Dependency graph changes must be reviewed by security or handled by maintainers internally. Please remove lockfile changes manually if they are not needed.

To remove lockfile changes, restore them from the target branch:

git fetch origin
git checkout 'origin/main' -- 'pnpm-lock.yaml'
git commit -m 'chore: remove dependency lockfile change'
git push

If this PR intentionally needs a dependency graph change, ask a repository admin or member of @openclaw/openclaw-secops to comment:

/allow-dependencies-change

The action will approve the current head SHA (c3390e60f5f92499258da749ee93da097d107d0f) when it reruns. A later push requires a fresh approval.

@RomneyDa
RomneyDa force-pushed the codex/crabline-provider-env-wiring branch from fe47539 to 6bd0fe2 Compare June 23, 2026 02:46
@RomneyDa RomneyDa mentioned this pull request Jun 23, 2026
Merged
@clawsweeper

clawsweeper Bot commented Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 29, 2026, 2:10 PM ET / 18:10 UTC.

Summary
This PR bumps QA Lab to @openclaw/crabline 0.1.4, updates lock/workspace dependency metadata, and adds WhatsApp Crabline transport contract tests.

PR surface: Tests +85, Config 0, Other +2. Total +87 across 4 files.

Reproducibility: not applicable. this is a QA Lab feature PR rather than a reported current-main bug. Source review shows current main has the shared env-forwarding and WhatsApp WebSocket seams, but not this Crabline 0.1.4 WhatsApp contract coverage.

Review metrics: 2 noteworthy metrics.

  • Dependency Graph Change: 1 direct bump; 2 transitive dependencies added. @openclaw/crabline moves from 0.1.3 to 0.1.4, adding ws and curve25519-js to the executable QA dependency graph.
  • Release-Age Exemption: 1 exact package exemption changed. The workspace freshness bypass now targets the new Crabline version, which needs maintainer confirmation before merge.

Root-cause cluster
Relationship: canonical
Canonical: #95920
Summary: This PR is the canonical remaining WhatsApp QA Lab Crabline follow-up; related merged PRs provide the Slack base and WhatsApp WebSocket seam it depends on.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Get exact-head maintainer/security approval for the Crabline dependency graph change.
  • [P2] Wait for the current-head Windows failure and pending checks to resolve before merge.

Risk before merge

  • [P1] The PR changes the executable QA dependency graph and remains blocked by dependency-guard until a maintainer/security owner approves the exact head.
  • [P1] @openclaw/[email protected] adds WebSocket and crypto-related dependencies for the fake WhatsApp server, so the package delta is a supply-chain review surface.
  • [P1] pnpm-workspace.yaml moves the minimum-release-age exemption to the fresh Crabline version, so maintainers should confirm that bypass is intentional.
  • [P1] Current-head checks include a Windows Node test failure and in-progress checks; those need ordinary CI follow-up before merge.

Maintainer options:

  1. Approve The Exact Crabline Delta (recommended)
    A maintainer/security owner can inspect @openclaw/[email protected], accept the new transitive dependencies and release-age exemption, then approve the current head before merge.
  2. Drop The Dependency Bump
    If the dependency delta is not intended for this PR, remove the package, lockfile, and release-age exemption changes and keep only coverage compatible with the approved Crabline version.
  3. Pause The WhatsApp Follow-Up
    If maintainers do not want to approve the fresh fake-server package now, leave this follow-up paused until the Crabline release is accepted through the normal dependency path.

Next step before merge

  • [P2] Human maintainer/security review is needed for exact-head dependency approval and current CI gates; there is no narrow automated code repair apparent.

Security
Needs attention: No malicious-code signal was found, but this PR changes the resolved executable QA dependency graph and needs exact-head dependency approval.

Review details

Best possible solution:

Approve the exact Crabline 0.1.4 dependency delta and release-age exemption after review, wait for current-head checks to settle, then merge the focused WhatsApp QA Lab follow-up if maintainers accept the package change.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a QA Lab feature PR rather than a reported current-main bug. Source review shows current main has the shared env-forwarding and WhatsApp WebSocket seams, but not this Crabline 0.1.4 WhatsApp contract coverage.

Is this the best way to solve the issue?

Yes, with merge gates: the PR uses existing QA Lab and WhatsApp seams instead of adding production runtime branches. The remaining issue is dependency/security approval and current-head CI, not a narrower automated code fix.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against aa5ec51af008.

Label changes

Label justifications:

  • P3: This is useful internal QA fake-provider coverage, not an urgent user-facing runtime regression.
  • merge-risk: 🚨 compatibility: The PR changes source-checkout dependency resolution and the exact minimum-release-age exemption for QA Lab.
  • merge-risk: 🚨 security-boundary: The PR changes an executable package graph and adds WebSocket/crypto dependency usage that must pass dependency approval.
  • merge-risk: 🚨 automation: A bad Crabline package contract would break QA Lab's fake-provider automation even if the OpenClaw runtime diff stays test-focused.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor proof gate does not apply because this is a member-authored, maintainer-labeled PR; the body lists targeted test/typecheck evidence.
Evidence reviewed

PR surface:

Tests +85, Config 0, Other +2. Total +87 across 4 files.

View PR surface stats
Area Files Added Removed Net
Source 0 0 0 0
Tests 1 86 1 +85
Docs 0 0 0 0
Config 2 2 2 0
Generated 0 0 0 0
Other 1 7 5 +2
Total 4 95 8 +87

Security concerns:

  • [medium] Dependency approval still required — extensions/qa-lab/package.json:19
    The PR bumps @openclaw/crabline and changes package, lockfile, and workspace dependency metadata while dependency guard is failing pending exact-head approval.
    Confidence: 0.95
  • [medium] Crabline adds WebSocket and crypto dependencies — pnpm-lock.yaml:9272
    @openclaw/[email protected] adds ws and curve25519-js compared with 0.1.3, making the package delta a supply-chain review surface.
    Confidence: 0.9

What I checked:

  • Live PR state: GitHub reports current head c3390e60f5f92499258da749ee93da097d107d0f, 4 changed files, MERGEABLE/UNSTABLE, and labels including maintainer, dependencies-changed, and the three merge-risk labels. (c3390e60f5f9)
  • Current main baseline: Current main still pins QA Lab to @openclaw/crabline 0.1.3, so the WhatsApp 0.1.4 contract is not already on main. (extensions/qa-lab/package.json:19, aa5ec51af008)
  • Existing env forwarding seam: Current main already merges transport.createRuntimeEnvPatch?.() into QA Lab gateway startup, so this PR can rely on the existing transport env-forwarding seam from the merged Slack transport base. (extensions/qa-lab/src/suite.ts:1561, aa5ec51af008)
  • Existing WhatsApp runtime seam: Current main resolves OPENCLAW_WHATSAPP_WEB_SOCKET_URL into Baileys waWebSocketUrl, so the PR uses an existing WhatsApp runtime hook rather than adding a new production socket override path. (extensions/whatsapp/src/session.ts:192, aa5ec51af008)
  • Dependency delta: Npm metadata for @openclaw/[email protected] matches the PR lockfile integrity and adds curve25519-js and ws compared with 0.1.3. (pnpm-lock.yaml:9272, c3390e60f5f9)
  • Dependency guard: Current PR checks include a failing dependency-guard check, matching the bot comment that exact-head dependency approval is required for this head SHA. (c3390e60f5f9)

Likely related people:

  • RomneyDa: Merged history shows RomneyDa authored the QA Lab Crabline env-forwarding base, the WhatsApp WebSocket env seam, and the follow-up validation that this PR builds on. (role: feature owner and recent area contributor; confidence: high; commits: 2cc43aec2deb, 0deddfa20428, 2ec670898018; files: extensions/qa-lab/src/crabline-transport.ts, extensions/qa-lab/src/suite.ts, extensions/whatsapp/src/session.ts)
  • NIO: Blame shows much of the pre-existing Crabline transport wrapper in the current checkout carried by a grafted base commit, but the commit title is not specific to this feature. (role: adjacent current-main code contributor; confidence: low; commits: 748bea343416; files: extensions/qa-lab/src/crabline-transport.ts, extensions/qa-lab/src/suite.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. labels Jun 23, 2026
@RomneyDa
RomneyDa force-pushed the codex/crabline-provider-env-wiring branch from 6bd0fe2 to adf399c Compare June 23, 2026 21:51
@github-actions github-actions Bot removed the dependencies-changed PR changes dependency-related files label Jun 23, 2026
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels Jun 24, 2026
@RomneyDa
RomneyDa force-pushed the codex/crabline-provider-env-wiring branch from ad9f3b1 to 9c50250 Compare June 24, 2026 07:12
@blacksmith-sh

This comment has been minimized.

Sign in to view
@openclaw-barnacle openclaw-barnacle Bot added size: L docs Improvements or additions to documentation and removed size: M labels Jun 24, 2026
@github-actions

github-actions Bot commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

  • extensions/qa-lab/package.json
  • pnpm-lock.yaml
  • pnpm-workspace.yaml

Maintainer follow-up:

  • Review whether the dependency changes are intentional.
  • Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
  • Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
  • Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

@github-actions github-actions Bot added the dependencies-changed PR changes dependency-related files label Jun 24, 2026
@clawsweeper clawsweeper Bot added the status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains. label Jun 27, 2026
@RomneyDa
RomneyDa force-pushed the codex/whatsapp-mock-socket-seam branch 3 times, most recently from e50621d to 8670e13 Compare June 29, 2026 02:17
Base automatically changed from codex/whatsapp-mock-socket-seam to main June 29, 2026 17:28
@openclaw-barnacle openclaw-barnacle Bot added channel: slack Channel integration: slack channel: whatsapp-web Channel integration: whatsapp-web scripts Repository scripts size: L and removed size: M labels Jun 29, 2026
@clawsweeper clawsweeper Bot added status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains. labels Jun 29, 2026
@RomneyDa RomneyDa mentioned this pull request Jun 29, 2026
Merged
@clawsweeper clawsweeper Bot mentioned this pull request Jun 29, 2026
Merged
@RomneyDa
RomneyDa force-pushed the codex/crabline-provider-env-wiring branch from 56e64d9 to 2e0c4d3 Compare June 29, 2026 17:50
@RomneyDa RomneyDa changed the title feat(qa): wire Crabline fake provider runtimes feat(qa): wire Crabline WhatsApp transport Jun 29, 2026
@RomneyDa
RomneyDa changed the base branch from main to codex/qa-crabline-slack June 29, 2026 17:50
@openclaw-barnacle openclaw-barnacle Bot removed channel: slack Channel integration: slack channel: whatsapp-web Channel integration: whatsapp-web scripts Repository scripts size: L labels Jun 29, 2026
@RomneyDa

RomneyDa commented Jun 29, 2026

Copy link
Copy Markdown
Member Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@socket-security

socket-security Bot commented Jun 29, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednpm/​@​openclaw/​crabline@​0.1.47710010093100

View full report

@github-actions github-actions Bot mentioned this pull request Jun 29, 2026
Open
This was referenced Jun 29, 2026
Merged
Closed
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies-changed PR changes dependency-related files extensions: qa-lab maintainer Maintainer-authored PR merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: S status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@RomneyDa