Skip to content

fix: route WhatsApp group activation through session accessor#96530

Merged
jalehman merged 1 commit into
openclaw:mainfrom
jalehman:josh/path3-whatsapp-group-activation-accessor
Jun 24, 2026
Merged

fix: route WhatsApp group activation through session accessor#96530
jalehman merged 1 commit into
openclaw:mainfrom
jalehman:josh/path3-whatsapp-group-activation-accessor

Conversation

@jalehman

@jalehman jalehman commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

WhatsApp group activation still used the legacy whole-session-store helpers to read and backfill group activation metadata. That kept this Path 3.1b slice tied to file-store mutation instead of the session accessor boundary tracked by #88838.

Why This Change Was Made

The SQLite migration needs WhatsApp group activation writes to go through per-entry accessor operations so the future backend can preserve transaction boundaries. This change keeps the existing legacy/scoped resolution behavior while removing direct loadSessionStore / updateSessionStore usage from the migrated runtime path.

User Impact

Users should see no behavior change. Named-account WhatsApp groups still inherit legacy activation settings, sparse activation-only backfills stay sparse, existing scoped session metadata is preserved, and default-account handling in multi-account configs remains mention-required when appropriate.

Evidence

Rebased head: 1d94cf49aa16c750129019c32ed8c0dbf72af9a2 on current upstream/main after the latest Path 3 sibling ratchet changes landed. GitHub reports mergeStateStatus=CLEAN; CI completed with 61 successful checks, 25 skipped checks, CodeQL neutral, and no failures.

  • node scripts/run-vitest.mjs extensions/whatsapp/src/auto-reply/monitor/group-activation.test.ts passed 4 tests on 1d94cf49aa1.
  • node scripts/run-vitest.mjs test/scripts/check-session-accessor-boundary.test.ts passed 31 tests on 1d94cf49aa1.
  • node scripts/check-session-accessor-boundary.mjs passed on 1d94cf49aa1.
  • node_modules/.bin/oxfmt --check --threads=1 extensions/whatsapp/src/auto-reply/monitor/group-activation.ts scripts/check-session-accessor-boundary.mjs test/scripts/check-session-accessor-boundary.test.ts passed on 1d94cf49aa1.
  • node scripts/run-tsgo.mjs -p tsconfig.extensions.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions.tsbuildinfo passed on 1d94cf49aa1.
  • autoreview --mode branch --base upstream/main reported no accepted/actionable findings on 1d94cf49aa1.
  • pnpm build passed in the live local checkout at pre-rebase proof head aa6aedd08669.
  • pnpm openclaw gateway restart, pnpm openclaw --version, pnpm openclaw gateway status, /healthz, and /readyz passed in the live local checkout at pre-rebase proof head aa6aedd08669.

Real behavior proof

Behavior addressed: WhatsApp group activation reads legacy/scoped metadata and backfills the scoped group key through the session accessor path without whole-store mutation.

Real environment tested: local live Gateway/runtime proof on Josh's machine, rebuilt from pre-rebase proof head aa6aedd08669 (OpenClaw 2026.6.10 (aa6aedd)) with Gateway restarted and healthy on port 18789. Later rebases only reconciled the ratchet list with merged Path 3 sibling work; they did not require another live proof run.

Exact steps or command run after this patch:

pnpm build
pnpm openclaw gateway restart
pnpm openclaw --version
pnpm openclaw gateway status
curl -fsS http://127.0.0.1:18789/healthz
curl -fsS http://127.0.0.1:18789/readyz
pnpm openclaw gateway call node.list --params '{}'
# Then ran a temporary node --import tsx runtime probe against a mktemp session store.

Evidence after fix: Gateway reported OpenClaw 2026.6.10 (aa6aedd), connectivity ok, /healthz returned {"ok":true,"status":"live"}, and /readyz returned {"ready":true,"failing":[]...}. The runtime probe returned:

{
  "sha": "aa6aedd08669",
  "proof": "whatsapp group activation accessor downgraded runtime proof",
  "externalTransport": false,
  "sparseBackfill": {
    "activation": "always",
    "scopedGroupActivation": "always",
    "scopedSessionId": null,
    "scopedUpdatedAt": null
  },
  "defaultAccountInMultiAccountConfig": {
    "activation": "mention"
  },
  "existingScopedEntry": {
    "activation": "always",
    "scopedGroupActivation": "always",
    "scopedSessionId": "scoped-session",
    "scopedUpdatedAt": 12345
  }
}

Observed result after fix: legacy named-account activation resolves to always, scoped activation is backfilled, sparse activation-only writes do not synthesize sessionId or updatedAt, existing scoped metadata is preserved, and the default account remains mention in the multi-account activation-only case.

What was not tested: external WhatsApp transport, Baileys authentication, real group receipt, and the future SQLite backend flip. This machine has no configured external WhatsApp/Baileys group transport; the downgraded proof scope was approved by Josh/coordinator.

Restore note

After the live proof, the local live checkout was restored to the original pre-proof SHA f8b29f82e2a, rebuilt, restarted, and checked healthy. Git could not reattach the original branch name because another worktree currently owns it, so the live checkout was restored to that exact SHA in detached mode.

@openclaw-barnacle openclaw-barnacle Bot added channel: whatsapp-web Channel integration: whatsapp-web scripts Repository scripts size: XS maintainer Maintainer-authored PR labels Jun 24, 2026
@jalehman jalehman mentioned this pull request Jun 24, 2026
Closed
@clawsweeper

clawsweeper Bot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 24, 2026, 4:09 PM ET / 20:09 UTC.

Summary
The PR routes WhatsApp group activation reads/backfills from whole-session-store helpers to getSessionEntry/patchSessionEntry and adds the resolver to the session accessor boundary ratchet.

PR surface: Source +14, Tests +1, Other +1. Total +16 across 3 files.

Reproducibility: yes. for the source-level migration target: current main and v2026.6.10 still use whole-store helpers in the WhatsApp group activation resolver. I did not run tests because this review is read-only, but the code path and PR diff make the target clear.

Review metrics: 1 noteworthy metric.

  • Accessor ratchet: 1 bundled plugin file added. The boundary guard will reject future whole-store session helper use in the WhatsApp group activation resolver after this slice lands.

Root-cause cluster
Relationship: partial_overlap
Canonical: #88838
Summary: This PR is one concrete WhatsApp group activation accessor slice under the broader open session/transcript SQLite accessor migration tracker.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

  • [P1] Merging changes the persisted WhatsApp group activation metadata read/backfill path; the supplied proof covers live Gateway/runtime accessor behavior but not external WhatsApp transport, Baileys authentication, real group receipt, or the future SQLite backend flip tracked at Track core session/transcript SQLite migration via accessor seam #88838.
  • [P1] The protected maintainer label requires explicit maintainer handling even though no line-level patch defect was found.

Maintainer options:

  1. Accept Scoped Accessor Proof (recommended)
    Proceed if maintainers agree the live Gateway/runtime probe is enough for this behavior-neutral accessor slice and real WhatsApp/Baileys group receipt is out of scope.
  2. Request Real WhatsApp Group Proof
    Ask for an external WhatsApp/Baileys group receipt run before merge if transport-level confidence is required for this session-state path.
  3. Pause Under The SQLite Tracker
    Leave the PR open under Track core session/transcript SQLite migration via accessor seam #88838 if maintainers want the remaining backend contract settled before accepting this storage-path slice.

Next step before merge

  • [P2] The remaining action is explicit maintainer acceptance of a protected session-state PR and its scoped proof gap; there is no concrete automated repair to queue.

Security
Cleared: Cleared: the diff changes a WhatsApp TypeScript helper plus local guard/test expectations, with no dependency, workflow, secret, package, or artifact-execution changes.

Review details

Best possible solution:

Land the narrow accessor migration after a maintainer accepts the scoped non-transport proof, while keeping the broader SQLite backend work tracked in #88838.

Do we have a high-confidence way to reproduce the issue?

Yes for the source-level migration target: current main and v2026.6.10 still use whole-store helpers in the WhatsApp group activation resolver. I did not run tests because this review is read-only, but the code path and PR diff make the target clear.

Is this the best way to solve the issue?

Yes, this is the narrow maintainable fix shape for this slice: it uses the existing session accessor API and ratchet without adding SDK surface, config, or a SQLite backend flip. The remaining question is maintainer acceptance of the proof scope, not a better code location.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 10e03f797efd.

Label changes

Label justifications:

  • P2: This is a normal-priority session accessor migration slice with limited WhatsApp blast radius and no active outage signal.
  • merge-risk: 🚨 session-state: The PR changes persisted WhatsApp group activation metadata reads/backfills and intentionally leaves real transport and future SQLite backend proof out of scope.
  • rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): Sufficient: the PR body includes after-patch live Gateway output and a runtime probe proving legacy/scoped WhatsApp activation reads and sparse backfills through the accessor path; the external transport gap is disclosed.
  • proof: sufficient: Contributor real behavior proof is sufficient. Sufficient: the PR body includes after-patch live Gateway output and a runtime probe proving legacy/scoped WhatsApp activation reads and sparse backfills through the accessor path; the external transport gap is disclosed.
Evidence reviewed

PR surface:

Source +14, Tests +1, Other +1. Total +16 across 3 files.

View PR surface stats
Area Files Added Removed Net
Source 1 28 14 +14
Tests 1 1 0 +1
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 1 1 0 +1
Total 3 30 14 +16

What I checked:

Likely related people:

  • mcaxtr: Earlier WhatsApp multi-account and scoped group activation commits introduced the legacy activation and scoped-key behavior this PR preserves while changing the storage access path. (role: WhatsApp group activation contributor; confidence: high; commits: 458a52610a4d, c5995ce5ecae; files: extensions/whatsapp/src/auto-reply/monitor/group-activation.ts, extensions/whatsapp/src/group-session-key.ts)
  • jalehman: Recent merged Path 3 work updated bundled session metadata accessor usage, the session accessor implementation, and the boundary ratchet that this PR extends. (role: recent session accessor migration contributor; confidence: high; commits: 7e2b2d2987b2, 4d4769c0d6a5, d716900929db; files: scripts/check-session-accessor-boundary.mjs, src/config/sessions/session-accessor.ts, src/plugin-sdk/session-store-runtime.ts)
  • steipete: History shows the plugin SDK session-store runtime helper surface used by this PR was exposed in earlier accessor migration work. (role: plugin SDK session-store runtime contributor; confidence: medium; commits: a71b810e43f8; files: src/plugin-sdk/session-store-runtime.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. labels Jun 24, 2026
@jalehman
jalehman force-pushed the josh/path3-whatsapp-group-activation-accessor branch from aa6aedd to c94fdd0 Compare June 24, 2026 18:43
@clawsweeper clawsweeper Bot added the merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. label Jun 24, 2026
@clawsweeper clawsweeper Bot mentioned this pull request Jun 24, 2026
Merged
@clawsweeper clawsweeper Bot added rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. labels Jun 24, 2026
@jalehman
jalehman force-pushed the josh/path3-whatsapp-group-activation-accessor branch from c94fdd0 to 9d72efc Compare June 24, 2026 19:24
@jalehman
jalehman force-pushed the josh/path3-whatsapp-group-activation-accessor branch from 9d72efc to 1d94cf4 Compare June 24, 2026 19:52
@jalehman
jalehman merged commit 2c714ac into openclaw:main Jun 24, 2026
101 checks passed
@jalehman
jalehman deleted the josh/path3-whatsapp-group-activation-accessor branch June 24, 2026 20:46
@github-actions github-actions Bot mentioned this pull request Jun 24, 2026
Open
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 25, 2026
@jalehman
fix(whatsapp): route group activation through session accessor (openc…
011d412 
…law#96530)
This was referenced Jun 25, 2026
Closed
Open
QiuYuang pushed a commit to QiuYuang/openclaw that referenced this pull request Jul 1, 2026
@jalehman @QiuYuang
fix(whatsapp): route group activation through session accessor (openc…
aa68f63 
…law#96530)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

channel: whatsapp-web Channel integration: whatsapp-web maintainer Maintainer-authored PR merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. scripts Repository scripts size: XS status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jalehman