Files

gsxdsm 8bc3d7b0a5 FN-6042: raise dependency security floors

Harden dependency floors and update the Vitest toolchain to patched releases.

- upgrade workspace vitest and @vitest/coverage-v8 dependencies to the 4.1 line across packages and plugins
- pin transitive protobufjs via pnpm overrides and lockfile updates to patched versions
- adapt Vitest configs, engine test helpers, and security-floor coverage for the new dependency baselines
- add the published CLI changeset and related workspace/package metadata updates included in the task branch

Files changed:
 .changeset/fn-6042-security-dependencies.md        |   5 +
 AGENTS.md                                          |   4 +
 Dockerfile                                         |   3 +
 docs/PLUGIN_AUTHORING.md                           |   2 -
 package.json                                       |   3 +-
 packages/cli/package.json                          |   4 +-
 packages/cli/vitest.config.ts                      |   2 +-
 packages/core/package.json                         |   4 +-
 packages/core/vitest.config.ts                     |   2 +-
 packages/dashboard/app/test/mockApi.ts             |   4 +-
 packages/dashboard/package.json                    |   4 +-
 packages/dashboard/vitest.config.ts                |   2 +-
 packages/desktop/package.json                      |   4 +-
 packages/desktop/vitest.config.ts                  |   2 +-
 packages/droid-cli/package.json                    |   2 +-
 packages/droid-cli/vitest.config.ts                |   2 +-
 packages/engine/package.json                       |   4 +-
 .../engine/src/__tests__/executor-test-helpers.ts  |  29 +-
 .../engine/src/__tests__/gridlock-detector.test.ts |   5 +-
 .../src/__tests__/heartbeat-scheduler.test.ts      |   3 +-
 packages/engine/src/__tests__/scheduler.test.ts    |  24 +-
 packages/engine/src/__tests__/self-healing.test.ts |   5 +
 packages/engine/tsconfig.json                      |   3 +-
 packages/engine/vitest.config.ts                   |  10 +-
 packages/i18n/package.json                         |   2 +-
 packages/i18n/vitest.config.ts                     |   7 +
 packages/mobile/package.json                       |   2 +-
 packages/mobile/vitest.config.ts                   |   2 +-
 packages/pi-claude-cli/package.json                |   2 +-
 packages/pi-claude-cli/vitest.config.ts            |   2 +-
 packages/pi-llama-cpp/package.json                 |   2 +-
 packages/pi-llama-cpp/vitest.config.ts             |   2 +-
 packages/plugin-sdk/package.json                   |   2 +-
 packages/plugin-sdk/vitest.config.ts               |   2 +-
 .../examples/fusion-plugin-auto-label/package.json |   2 +-
 .../fusion-plugin-auto-label/vitest.config.ts      |   2 +-
 .../examples/fusion-plugin-ci-status/package.json  |   2 +-
 .../fusion-plugin-ci-status/vitest.config.ts       |   2 +-
 .../fusion-plugin-notification/package.json        |   2 +-
 .../fusion-plugin-notification/vitest.config.ts    |   2 +-
 .../fusion-plugin-settings-demo/package.json       |   2 +-
 .../fusion-plugin-settings-demo/vitest.config.ts   |   2 +-
 plugins/fusion-plugin-acp-runtime/package.json     |   2 +-
 plugins/fusion-plugin-acp-runtime/vitest.config.ts |   2 +-
 plugins/fusion-plugin-agent-browser/package.json   |   2 +-
 .../fusion-plugin-agent-browser/vitest.config.ts   |   2 +-
 .../fusion-plugin-cli-printing-press/package.json  |   2 +-
 .../vitest.config.ts                               |   2 +-
 .../package.json                                   |   2 +-
 .../src/__tests__/orchestrator-live-output.test.ts |   4 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-cursor-runtime/package.json  |   4 +-
 .../fusion-plugin-dependency-graph/package.json    |   4 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-droid-runtime/package.json   |   2 +-
 .../fusion-plugin-droid-runtime/vitest.config.ts   |   2 +-
 plugins/fusion-plugin-even-cards/package.json      |   2 +-
 plugins/fusion-plugin-even-cards/vitest.config.ts  |   2 +-
 .../package.json                                   |   2 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-hermes-runtime/package.json  |   2 +-
 .../fusion-plugin-hermes-runtime/vitest.config.ts  |   2 +-
 .../fusion-plugin-openclaw-runtime/package.json    |   2 +-
 .../vitest.config.ts                               |   2 +-
 .../fusion-plugin-paperclip-runtime/package.json   |   2 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-reports/package.json         |   2 +-
 .../src/__tests__/review-panel.test.ts             |   6 +-
 plugins/fusion-plugin-reports/vitest.config.ts     |   2 +-
 plugins/fusion-plugin-roadmap/package.json         |   2 +-
 plugins/fusion-plugin-roadmap/vitest.config.ts     |   2 +-
 plugins/fusion-plugin-whatsapp-chat/package.json   |   2 +-
 .../fusion-plugin-whatsapp-chat/vitest.config.ts   |   2 +-
 pnpm-lock.yaml                                     | 626 ++++++++-------------
 .../__tests__/dependency-security-floor.test.mjs   |  95 ++++
 75 files changed, 475 insertions(+), 491 deletions(-)

Fusion-Task-Id: FN-6042

Fusion-Task-Lineage: fff6a1cb-8937-435c-9a91-b7c7a59cc80e

2026-06-08 15:19:27 -07:00

src

fix(FN-3794): pass unload context and isolate WhatsApp sessions per project

2026-05-09 10:31:04 -07:00

CHANGELOG.md

chore(release): v0.39.0

2026-05-31 20:05:32 -07:00

manifest.json

feat(FN-3713): migrate WhatsApp plugin to Baileys pairing flow

2026-05-07 18:26:14 -07:00

package.json

FN-6042: raise dependency security floors

2026-06-08 15:19:27 -07:00

README.md

feat(FN-3795): add WhatsApp dedupe retention pruning and reports plugin sca

2026-05-09 10:31:04 -07:00

tsconfig.json

feat(FN-3714): add WhatsApp chat plugin with plugin discovery and install U

2026-05-07 14:28:29 -07:00

vitest.config.ts

FN-6042: raise dependency security floors

2026-06-08 15:19:27 -07:00

README.md

WhatsApp Chat Plugin

WhatsApp Web (Baileys) bridge for Fusion. It pairs with your phone (QR or pairing code), keeps a background connection alive, forwards inbound direct text messages to a Fusion AI session, and sends the assistant reply back to WhatsApp.

No Meta Cloud app, webhook URL, verify token, or Graph API credentials are required.

Setup

Enable/install the plugin in Plugin Manager.
Configure allowedSenders (empty means nobody is allowed).
Choose pairingMode:
- qr (default): fetch QR from /api/plugins/fusion-plugin-whatsapp-chat/qr and scan in WhatsApp.
- code: set pairingPhoneNumber (E.164 digits without +) and request code via /pair-code.
Confirm /status reports connected.

Settings

pairingMode: qr or code.
pairingPhoneNumber: E.164 digits without + (used for code mode).
allowedSenders: allowed WhatsApp JIDs or E.164 digits.
agentSystemPrompt: system prompt for replies.
historyTurnLimit: persisted turn window (default 40).
dedupeRetentionDays: replay-protection retention window for inbound message IDs (default 7 days). Rows older than this are pruned lazily whenever a new inbound message is processed.

Routes

GET /api/plugins/fusion-plugin-whatsapp-chat/status
GET /api/plugins/fusion-plugin-whatsapp-chat/qr
POST /api/plugins/fusion-plugin-whatsapp-chat/pair-code
POST /api/plugins/fusion-plugin-whatsapp-chat/logout

Storage and lifecycle

Starts socket on onLoad, stops on onUnload.
Persists transcript and dedupe state in:
- whatsapp_chat_sessions
- whatsapp_chat_dedupe
Persists Baileys auth state in:
- whatsapp_auth_creds
- whatsapp_auth_keys
After restart, plugin reconnects automatically when auth is valid.

Troubleshooting

Stuck awaiting-qr: fetch a fresh QR and scan promptly.
loggedOut: call /logout (or wait for clear) and re-pair.
Pair code not generated: ensure pairingPhoneNumber is E.164 digits without +.
No replies: check allowedSenders; empty list blocks all inbound messages by design.

Compliance warning

Baileys is an unofficial WhatsApp Web protocol client. Use may violate WhatsApp Terms of Service. This plugin is intended for self-hosted, single-user use at your own risk.