fix(whatsapp): lower upload-file media sends by ngutman · Pull Request #81883 · openclaw/openclaw

ngutman · 2026-05-14T18:23:18Z

Summary

Lower WhatsApp-targeted message(action="upload-file") calls with path/URL media into the existing send + media path.
Preserve hydrated media buffers for gateway/document sends so scoped file reads are not repeated inside the WhatsApp runtime.
Preserve explicit document media kind, and enforce WhatsApp media size limits for direct base64 buffer upload-file payloads.
Keep WhatsApp's native action discovery unchanged; this only handles shared-message-tool calls that resolve to WhatsApp at execution time.

Verification

node scripts/run-vitest.mjs extensions/whatsapp/src/channel-react-action.test.ts extensions/whatsapp/src/channel-actions.test.ts extensions/whatsapp/src/send.test.ts src/infra/outbound/message-action-runner.media.test.ts src/infra/outbound/message-action-params.test.ts
pnpm plugin-sdk:api:check
pnpm check:changed
$codex-review: clean after accepted review fixes
Live source-build WhatsApp direct send from ssh guti@100.65.30.41:~/projects/openclaw at d043bd519e: pnpm openclaw message send --channel whatsapp --target +972523594699 --media /tmp/openclaw-wa-upload-test.md --force-document --message "PR 81883 source-build live upload test" --json returned WhatsApp message id 3EB09D321AFFE4F9F48473.
Live source-build WhatsApp agent/message-tool send from the same checkout using message(action="upload-file", channel="whatsapp", filePath="/Users/guti/.openclaw/media/outbound/openclaw-wa-upload-test-source-build.md") returned WhatsApp message id 3EB0A344E3B27AD4BE9460.

Behavior addressed: A shared message tool call using action=upload-file with a media path/URL no longer fails after resolving to WhatsApp; it is delivered through WhatsApp's supported send-media path while preserving scoped hydrated media and document semantics.

Real environment tested: Local OpenClaw source checkout with targeted Vitest coverage and changed-file validation; remote source install running this branch at d043bd519e with a configured WhatsApp channel and running gateway service.

Exact steps or command run after this patch: node scripts/run-vitest.mjs extensions/whatsapp/src/channel-react-action.test.ts extensions/whatsapp/src/channel-actions.test.ts extensions/whatsapp/src/send.test.ts src/infra/outbound/message-action-runner.media.test.ts src/infra/outbound/message-action-params.test.ts; pnpm plugin-sdk:api:check; pnpm check:changed; fast-forward remote source checkout, rebuild via pnpm openclaw --version, then run direct WhatsApp CLI media send and a WhatsApp-bound agent prompt that calls the shared message tool once with action=upload-file and a Markdown file under OpenClaw's managed media directory.

Evidence after fix: Regression tests pass for WhatsApp upload-file path lowering, hydrated buffer reuse, explicit document media kind, and buffer size enforcement. The direct source-build WhatsApp send returned message id 3EB09D321AFFE4F9F48473; the agent/message-tool upload-file path returned tool result { ok: true, channel: "whatsapp", action: "upload-file", messageId: "3EB0A344E3B27AD4BE9460" }.

Observed result after fix: Focused tests report 5 passed files / 101 passed tests. The final code review pass reported no accepted/actionable findings. The configured WhatsApp chat receives the uploaded Markdown file from both the direct CLI send path and the agent message(action="upload-file") path when the file is under an allowed OpenClaw media root.

What was not tested: The live WhatsApp proof used managed local Markdown files rather than a direct base64 buffer payload. Buffer payload behavior is covered by focused tests, including WhatsApp media size-limit rejection.

clawsweeper · 2026-05-14T18:27:02Z

Codex review: needs maintainer review before merge.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Summary
The PR teaches the WhatsApp plugin to advertise and handle shared message(action="upload-file") media sends by routing hydrated path, URL, and base64 payloads through sendMessageWhatsApp, with media/document tests and a changelog entry.

Reproducibility: yes. Source inspection on current main shows WhatsApp does not advertise or support upload-file, so a shared upload-file action resolved to WhatsApp reaches the unsupported-action path; I did not execute a runtime repro because this review is read-only.

PR rating
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Summary: Good normal PR quality: source review supports the fix shape, tests and live proof are reported, and no blocking findings were found in the read-only pass.

Rank-up moves:

none

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Real behavior proof
Not applicable: The external-contributor proof gate does not apply to this MEMBER-authored, maintainer-labeled PR; the PR body nevertheless includes live source-build WhatsApp send results.

Mantis proof suggestion
A short visible WhatsApp Web proof would materially help reviewers confirm attachment delivery for the transport path, even though it is not required by the external proof gate. A maintainer can ask Mantis to capture proof by posting a new PR comment that starts with the OpenClaw Mantis account mention, followed by:

visual task: verify that message(action=upload-file) with a local media path sends an attachment through WhatsApp Web and reports a message id.

Risk before merge
Why this matters: - This review was read-only, so I did not rerun the PR's reported tests or live WhatsApp proof locally.

Normal maintainer review and CI still need to gate the WhatsApp live-delivery path before merge.

Maintainer options:

Decide the mitigation before merge
Land the plugin-owned WhatsApp upload-file lowering after explicit maintainer review and normal CI, keeping core plugin-agnostic while preserving hydrated media buffers and forced-document semantics.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge
This is a protected maintainer-labeled MEMBER PR with no narrow ClawSweeper repair needed; the next action is maintainer review plus normal merge gating.

Security
Cleared: The diff stays in WhatsApp plugin code, shared outbound media parameter handling, tests, and changelog, with no new dependencies, workflows, package resolution, secrets, or broader code-execution surface.

Review details

Best possible solution:

Land the plugin-owned WhatsApp upload-file lowering after explicit maintainer review and normal CI, keeping core plugin-agnostic while preserving hydrated media buffers and forced-document semantics.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection on current main shows WhatsApp does not advertise or support upload-file, so a shared upload-file action resolved to WhatsApp reaches the unsupported-action path; I did not execute a runtime repro because this review is read-only.

Is this the best way to solve the issue?

Yes. The latest diff keeps the lowering inside the WhatsApp plugin, reuses the existing WhatsApp send-media transport, and avoids the earlier core-specific branching called out in review.

Label justifications:

P2: This is a focused WhatsApp shared-message-tool delivery fix with plugin-scoped blast radius and no evidence of a broader outage.

What I checked:

Protected PR state: The provided GitHub context shows author association MEMBER and the protected maintainer label, so this PR must remain open for explicit maintainer handling rather than cleanup closure. (d043bd519ee9)
Current main lacks WhatsApp upload-file action support: On current main, WhatsApp action discovery adds react and poll but not upload-file, while the channel action adapter only supports react. (extensions/whatsapp/src/channel.ts:154, 125ebd09876f)
Unsupported action failure path is source-reproducible: The shared action dispatcher returns null when supportsAction rejects an action, and the runner then throws Message action ${action} not supported for channel ${channel}. (src/infra/outbound/message-action-runner.ts:1213, 125ebd09876f)
PR diff keeps the fix in the WhatsApp plugin boundary: The latest PR diff adds upload-file to WhatsApp discovery/support, routes the action through the lazy WhatsApp action module, preserves media access inputs, and reuses sendMessageWhatsApp instead of hardcoding WhatsApp policy in core. (extensions/whatsapp/src/channel-react-action.ts:1, d043bd519ee9)
Contributor-reported validation and live proof: The PR body reports focused Vitest files, pnpm plugin-sdk:api:check, pnpm check:changed, and live source-build WhatsApp direct plus agent/message-tool sends returning message ids 3EB09D321AFFE4F9F48473 and 3EB0A344E3B27AD4BE9460. (d043bd519ee9)
Relevant history and ownership signals: History around WhatsApp action seams and outbound media points to recent work by Peter Steinberger, Marcus Castro, Gustavo Madeira Santana, and Vincent Koc across WhatsApp gateway actions and shared message-action/media plumbing. (extensions/whatsapp/src/channel-react-action.ts:13, 8bfdffad32ac)

Likely related people:

steipete: Current blame and recent logs attribute the checked-out WhatsApp action/outbound helper snapshots and shared outbound-media plumbing to Peter Steinberger, including work around upload-file unification and media access. (role: recent area contributor; confidence: high; commits: 8bfdffad32ac, ba6015482654, 3bb02d333865; files: extensions/whatsapp/src/channel.ts, extensions/whatsapp/src/channel-react-action.ts, src/infra/outbound/message-action-params.ts)
mcaxtr: Marcus Castro appears in recent WhatsApp action history for gateway-routed reactions and group reaction behavior, which is adjacent to this PR's plugin-owned message-action execution path. (role: WhatsApp action behavior contributor; confidence: medium; commits: aaae1aeb8f56, 9af8288c05af; files: extensions/whatsapp/src/channel-react-action.ts, extensions/whatsapp/src/action-runtime.ts)
gumadeiras: Gustavo Madeira Santana appears in recent shared message-action discovery and outbound test history, which is relevant to upload-file hydration and plugin action discovery. (role: shared message-action contributor; confidence: medium; commits: 3ca8ad38459c, 7ae670e50159; files: src/infra/outbound/message-action-params.ts, src/channels/plugins/message-action-discovery.ts)
vincentkoc: Vincent Koc appears in WhatsApp lazy action seam and runtime dependency history, adjacent to the PR's lazy channel-react-action path and plugin runtime boundary. (role: WhatsApp seam contributor; confidence: medium; commits: 2050ef2740df, 8d3bd4859ee5; files: extensions/whatsapp/src/channel.ts, extensions/whatsapp/src/channel-react-action.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 125ebd09876f.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c1d556c92f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ngutman · 2026-05-18T13:09:32Z

Merged via squash.

Prepared head SHA: 3b2ae9c80dc43c7912c1f33677928db3e8b89e2f
Merge commit: 29f39db8578c521d7d19a9acbe3ff9b02121928b

Thanks @ngutman!

@ngutman

Merged via squash. Prepared head SHA: 3b2ae9c Co-authored-by: ngutman <1540134+ngutman@users.noreply.github.com> Co-authored-by: ngutman <1540134+ngutman@users.noreply.github.com> Reviewed-by: @ngutman

@ngutman

Merged via squash. Prepared head SHA: 3b2ae9c Co-authored-by: ngutman <1540134+ngutman@users.noreply.github.com> Co-authored-by: ngutman <1540134+ngutman@users.noreply.github.com> Reviewed-by: @ngutman

openclaw-barnacle Bot added docs Improvements or additions to documentation size: S maintainer Maintainer-authored PR labels May 14, 2026

chatgpt-codex-connector Bot reviewed May 14, 2026

View reviewed changes

Comment thread src/infra/outbound/message-action-runner.ts Outdated

ngutman force-pushed the fix/whatsapp-upload-file-media-scoped branch from c1d556c to 0155f38 Compare May 14, 2026 19:00

openclaw-barnacle Bot added channel: whatsapp-web Channel integration: whatsapp-web and removed docs Improvements or additions to documentation labels May 14, 2026

ngutman force-pushed the fix/whatsapp-upload-file-media-scoped branch from 0155f38 to ce65dd8 Compare May 18, 2026 07:24

openclaw-barnacle Bot added size: L and removed size: S labels May 18, 2026

ngutman requested a review from a team as a code owner May 18, 2026 12:57

github-actions Bot added the dependencies-changed PR changes dependency-related files label May 18, 2026

ngutman added 4 commits May 18, 2026 16:04

fix(whatsapp): support upload-file media sends

5f3554f

fix(whatsapp): expose upload-file action discovery

24a5ccc

fix(whatsapp): preserve scoped upload-file media

701a0bf

docs(changelog): credit whatsapp upload-file fix

3b2ae9c

ngutman force-pushed the fix/whatsapp-upload-file-media-scoped branch from 27f133d to 3b2ae9c Compare May 18, 2026 13:07

ngutman merged commit 29f39db into main May 18, 2026
98 checks passed

ngutman deleted the fix/whatsapp-upload-file-media-scoped branch May 18, 2026 13:09

clawsweeper Bot mentioned this pull request May 18, 2026

[Bug]: message action "send" silently ignores buffer/filename for Telegram attachments and returns ok=true #41779

Closed

github-actions Bot mentioned this pull request May 18, 2026

📡 Upstream Digest — 2026-05-18 14:57 UTC curtismercier/openclaw-mods#890

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(whatsapp): lower upload-file media sends#81883

fix(whatsapp): lower upload-file media sends#81883
ngutman merged 4 commits into
mainfrom
fix/whatsapp-upload-file-media-scoped

ngutman commented May 14, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 14, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

ngutman commented May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ngutman commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Uh oh!

clawsweeper Bot commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

ngutman commented May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ngutman commented May 14, 2026 •

edited

Loading

clawsweeper Bot commented May 14, 2026 •

edited

Loading