Keep media upload streaming instead of full-buffer reads

Replacing createReadStream(filePath) with await fs.readFile(filePath) forces every media upload to hold the entire encrypted payload in memory before the request is sent. For large WhatsApp documents/videos (or multiple concurrent sends), this can spike RSS by payload size per upload and trigger OOM/restarts in production, which is a regression from the previous streaming behavior.

Useful? React with 👍 / 👎.

Keep media uploads streaming instead of buffering whole file

Replacing createReadStream(filePath) with await fs.readFile(filePath) forces every encrypted media upload to be fully materialized in memory before POSTing. For large WhatsApp documents/videos (and especially concurrent sends), this can create major RSS spikes, trigger GC/OOM failures, and drop uploads that previously worked with bounded memory via streaming; this is a runtime regression in the hot upload path rather than a cosmetic refactor.

Useful? React with 👍 / 👎.

Fall back to install when transitive closure lookup fails

When collectInstalledRuntimeClosure() returns null, this code now keeps staging with only direct dependencies instead of aborting root staging. That can produce incomplete dist/extensions/*/node_modules trees whenever a transitive package is missing/incompatible at the root (for example platform-optional transitives), because hoisted layouts often keep required transitives outside the direct package folder; copying only the direct package then leads to runtime MODULE_NOT_FOUND failures. The previous behavior (return false) correctly fell back to npm install for a complete closure.

Useful? React with 👍 / 👎.

Remove duplicated openclaw.bundle key

This adds a second openclaw.bundle object even though the same key already exists later in the same openclaw object. Duplicate keys in JSON are ambiguous (many parsers keep only the last occurrence), so a future edit to one block can be silently ignored and cause confusing staging behavior drift. Keep a single canonical bundle entry.

Useful? React with 👍 / 👎.

Ship Baileys dispatcher fix beyond pnpm-only patching

This change delivers the WhatsApp upload fix only through pnpm.patchedDependencies, but the shipped install path still installs bundled plugin deps with npm install (scripts/postinstall-bundled-plugins.mjs:423-438), where the only runtime rewrite is the encrypted-stream flush hotfix (scripts/postinstall-bundled-plugins.mjs:41-57). That means npm/global installs can still run unpatched Baileys upload code and hit TypeError: agent.dispatch is not a function with non-Undici agents, so the dispatcher hardening in this commit is not actually applied in that environment.

Useful? React with 👍 / 👎.

Handle patched encrypted-stream variant before bailing out

The hotfix matcher now assumes only one “already patched” form (await Promise.all(...)), but this same commit adds a pnpm patch that uses the equivalent sequential awaits (await encFinishPromise; await originalFinishPromise;). In that valid patched state, this branch returns unexpected_content immediately, which causes source-checkout postinstall runs to warn on every install and prevents dispatcher-only patching for that file variant. Please accept the sequential-await form as patched (or continue to the dispatcher patch path) instead of returning early.

Useful? React with 👍 / 👎.

Treat commented sequential Baileys patch as already applied

This detection path relies on an exact multiline match for the sequential encrypted-stream replacement, then falls back to requiring the old unpatched needle. The new pnpm patch in this commit adds comment lines between those statements, so a file that is already patched via patches/@whiskeysockets__baileys@7.0.0-rc.9.patch does not match either form and returns unexpected_content. In source-checkout postinstall runs, that makes the hotfix non-idempotent (spurious warning every install) and can skip dispatcher backfill in mixed states where only the commented sequential variant is present.

Useful? React with 👍 / 👎.