fix: patch OpenClaw scope-clearing bug and refactor WhatsApp session logout logic to error handler

start.sh

@@ -264,6 +264,41 @@ chmod 600 /home/node/.openclaw/openclaw.json
 # This preload script keeps iframe embedding working on HF Spaces.
 export NODE_OPTIONS="${NODE_OPTIONS:+$NODE_OPTIONS }--require /home/node/app/iframe-fix.cjs"
 
+# ── Patch OpenClaw scope-clearing bug for headless HF auth ──
+# OpenClaw can clear requested operator scopes after allowing a token-auth
+# connection without device identity, which breaks the WhatsApp guardian's
+# web.login.wait / channels.status calls on Spaces.
+patch_openclaw_scope_bug() {
+  local roots=(
+    "/home/node/.openclaw/openclaw-app"
+    "/usr/local/lib/node_modules/openclaw"
+  )
+  local target=""
+  local updated=0
+
+  for root in "${roots[@]}"; do
+    [ -d "$root/dist" ] || continue
+    target=$(find "$root/dist" -maxdepth 1 -type f -name 'gateway-cli-*.js' | head -n 1)
+    [ -n "$target" ] || continue
+
+    if grep -q 'return params.decision.kind !== "allow" || !params.controlUiAuthPolicy.allowBypass' "$target"; then
+      perl -0pi -e 's@return params\.decision\.kind !== "allow" \|\| !params\.controlUiAuthPolicy\.allowBypass && !params\.preserveInsecureLocalControlUiScopes && \(params\.authMethod === "token" \|\| params\.authMethod === "password" \|\| params\.authMethod === "trusted-proxy" \|\| params\.trustedProxyAuthOk === true\);@return params.decision.kind !== "allow";@g' "$target"
+
+      if grep -q 'return params.decision.kind !== "allow";' "$target"; then
+        echo "🔧 Patched OpenClaw scope-clearing bug in $(basename "$target")"
+        updated=1
+        break
+      fi
+    fi
+  done
+
+  if [ "$updated" -eq 0 ]; then
+    echo "⚠️  OpenClaw scope patch not applied (bundle format may have changed)"
+  fi
+}
+
+patch_openclaw_scope_bug
+
 # ── Startup Summary ──
 echo ""
 echo "  ┌──────────────────────────────────────────┐"

wa-guardian.js

@@ -121,50 +121,6 @@ async function checkStatus() {
   let ws;
   try {
     ws = await createConnection();
-
-    // Check if WhatsApp channel exists and its status
-    const statusRes = await callRpc(ws, "channels.status", {});
-    const channels = (statusRes.payload || statusRes.result)?.channels || {};
-    const wa = channels.whatsapp;
-
-    if (!wa) {
-      ws.close();
-      return;
-    }
-
-    const lastError = String(wa.lastError || "").toLowerCase();
-    const recentlySaw515 = Date.now() - last515At < POST_515_NO_LOGOUT_MS;
-    const needsLogout = wa.linked && !wa.connected && !recentlySaw515 &&
-      (
-        lastError.includes("401") ||
-        lastError.includes("unauthorized") ||
-        lastError.includes("logged out") ||
-        lastError.includes("440") ||
-        lastError.includes("conflict")
-      );
-
-    if (needsLogout) {
-      console.log("[guardian] Clearing invalid WhatsApp session so a fresh QR can be used...");
-      try {
-        await callRpc(ws, "channels.logout", { channel: "whatsapp" });
-        writeResetMarker();
-        hasShownWaitMessage = false;
-        console.log("[guardian] Logged out invalid WhatsApp session.");
-      } catch (error) {
-        console.log(`[guardian] Failed to log out invalid session: ${error.message}`);
-      }
-      ws.close();
-      return;
-    }
-
-    // If connected, we are good
-    if (wa.connected) {
-      hasShownWaitMessage = false;
-      ws.close();
-      return;
-    }
-
-    // If "Ready to pair", we wait for the scan
     isWaiting = true;
     if (!hasShownWaitMessage) {
       console.log("\n[guardian] 📱 WhatsApp pairing in progress. Please scan the QR code in the Control UI.");
@@ -200,6 +156,23 @@ async function checkStatus() {
     }
 
   } catch (e) {
+    const message = e && e.message ? e.message : "";
+    if (
+      /401|unauthorized|logged out|440|conflict/i.test(message) &&
+      Date.now() - last515At >= POST_515_NO_LOGOUT_MS
+    ) {
+      console.log("[guardian] Clearing invalid WhatsApp session so a fresh QR can be used...");
+      try {
+        if (ws) {
+          await callRpc(ws, "channels.logout", { channel: "whatsapp" });
+          writeResetMarker();
+          hasShownWaitMessage = false;
+          console.log("[guardian] Logged out invalid WhatsApp session.");
+        }
+      } catch (error) {
+        console.log(`[guardian] Failed to log out invalid session: ${error.message}`);
+      }
+    }
     // Normal timeout or gateway starting up; retry on the next interval.
   } finally {
     isWaiting = false;