- Hooks/cron: log returned `/hooks/agent` isolated-run errors and failed cron jobs with cron diagnostic summaries, so rejected `payload.model` values are visible instead of looking like accepted-but-missing runs. Fixes #78597. (#78655) Thanks @kevinslin.

- Managed proxy/security: classify raw socket callsites and proxy runtime mutations in boundary checks so new direct egress or unmanaged proxy-state changes cannot land without explicit review. (#77126) Thanks @jesse-merhi.

- Channels/iMessage: surface the silent group-allowlist drop at default log level by emitting a one-time `warn` per account at monitor startup when `channels.imessage.groupPolicy: "allowlist"` is set without a `channels.imessage.groups` block, plus a one-time `warn` per `chat_id` when the runtime gate drops a specific group, naming the exact `channels.imessage.groups[...]` key to add to allow it. Fixes #78749. (#79190) Thanks @omarshahine.

- WhatsApp: stop Gateway-originated outbound echoes from advancing inbound activity in `openclaw channels status`, so outbound self-sends no longer look like handled inbound messages. Fixes #79056. (#79057) Thanks @ai-hpc and @bittoby.

## 2026.5.3-1

return (typeof isJidGroup === "function" ? isJidGroup(jid) : jid.endsWith("@g.us")) === true;

}

function recordAcceptedInboundActivity(accountId: string): void {

recordChannelActivity({

channel: "whatsapp",

accountId,

direction: "inbound",

});

}

function isRetryableSendDisconnectError(err: unknown): boolean {

return /closed|reset|timed\s*out|disconnect|no active socket/i.test(formatError(err));

}

return;

}

for (const msg of upsert.messages ?? []) {

recordChannelActivity({

channel: "whatsapp",

accountId: options.accountId,

direction: "inbound",

});

const inbound = await normalizeInboundMessage(msg);

if (!inbound) {

continue;

continue;

}

recordAcceptedInboundActivity(options.accountId);

await enqueueInboundMessage(msg, inbound, enriched);

}

};

import {

buildNotifyMessageUpsert,

expectPairingPromptSent,

getRecordChannelActivityMock,

installWebMonitorInboxUnitTestHooks,

mockLoadConfig,

settleInboundWork,

return { onMessage, listener, sock };

}

function expectOnlyOutboundChannelActivity(accountId = "default") {

const recordChannelActivityMock = getRecordChannelActivityMock();

expect(recordChannelActivityMock).toHaveBeenCalledWith({

channel: "whatsapp",

accountId,

direction: "outbound",

});

expect(recordChannelActivityMock).not.toHaveBeenCalledWith({

channel: "whatsapp",

accountId,

direction: "inbound",

});

}

async function expectOutboundDmSkipsPairing(params: {

selfChatMode: boolean;

messageId: string;

await settleInboundWork();

expect(onMessage).not.toHaveBeenCalled();

expectOnlyOutboundChannelActivity();

await listener.close();

});

await settleInboundWork();

expect(onMessage).not.toHaveBeenCalled();

expectOnlyOutboundChannelActivity();

await listener.close();

});

sock: undefined as MockSock | undefined,

}));

const channelActivityMocks = vi.hoisted(() => ({

recordChannelActivity: vi.fn(),

}));

export function getRecordChannelActivityMock(): AnyMockFn {

return channelActivityMocks.recordChannelActivity;

}

vi.mock("openclaw/plugin-sdk/channel-activity-runtime", async () => {

const actual = await vi.importActual<

typeof import("openclaw/plugin-sdk/channel-activity-runtime")

>("openclaw/plugin-sdk/channel-activity-runtime");

return {

...actual,

recordChannelActivity: (...args: unknown[]) =>

channelActivityMocks.recordChannelActivity(...args),

};

});

const inboundRuntimeMocks = vi.hoisted(() => {

const wrapperKeys = [

"ephemeralMessage",

beforeEach(async () => {

vi.useRealTimers();

vi.clearAllMocks();

channelActivityMocks.recordChannelActivity.mockClear();

sessionState.sock = createMockSock();

resetPairingSecurityMocks(DEFAULT_WEB_INBOX_CONFIG);

if (!monitorWebInbox || !resetWebInboundDedupe) {