Re-vendor wacli to upstream openclaw/wacli v0.11.x (fixes auth loss, stale sync, lock contention)

[mattmezza]

Vendored tools/wacli/ is a stale pre-0.5 snapshot (committed 2026-02-20, version string 0.5.0-Unreleased, whatsmeow pinned 2026-02-11, module github.com/steipete/wacli). Upstream moved to github.com/openclaw/wacli and is now v0.11.x. All three known problems are already fixed upstream.

Why current pain happens (each maps to a shipped upstream fix)

• Auth keeps being lost
  • 0.5.0: whatsmeow protocol update fixing 405 Client Outdated — WhatsApp force-unlinks outdated clients; our whatsmeow is Feb-2026. Likely root cause feat: expose and control system prompt from admin UI #1.
  • 0.10.0: sends available presence after connect so the server records the linked-device pushname (un-presenced devices get dropped).
• Sync never up to date
  • 0.11.1: reconnect after WhatsApp replaces the linked-device stream, instead of leaving sync --follow offline. Direct hit.
  • 0.7.0: extensive sync-reliability + store-locking fixes. 0.11.0: correct storage of messages from other linked devices.
• Lock complaints
  • 0.6.0: bound reconnect duration so long commands don't hold the store lock forever. Direct hit — sync --follow/reconnect pins ~/.wacli/LOCK.
  • 0.7.0: new global flags --lock-wait DUR (wait instead of fail-fast), --read-only (skip session-store lock), --events (NDJSON).
  • 0.10.0: media download --read-only (no session lock).

The 3 local vendoring patches are now redundant (drop them)

• main.go device label "MPA" → use env WACLI_DEVICE_LABEL=MPA (+ WACLI_DEVICE_PLATFORM), native since 0.2.0.
• client.go strip + from phone → native E.164 canonicalization since 0.9.0.
• client.go wait-for-Connected → superseded by 0.10.0 presence/connect handling.

Plan

1. De-vendor. Remove tools/wacli/ source tree; install a pinned upstream binary:
   go install -tags sqlite_fts5 github.com/openclaw/wacli/cmd/wacli@v0.11.1
   (build alt: CGO_ENABLED=1 CGO_CFLAGS="-Wno-error=missing-braces" go build -tags sqlite_fts5 ...). Point core/wacli.py at the new binary.
2. Replace patches with config: set WACLI_DEVICE_LABEL=MPA in the wrapper env; delete the other two patches.
3. Harden wrapper (core/wacli.py): add --lock-wait 30s to every call; add --read-only to read commands (messages/chats/search/contacts/media download); run a single long-lived sync --follow (self-reconnects post-0.11.1) with reads alongside it.
4. Re-auth once after upgrade (wacli auth, QR rescan) — crossing the 405 boundary + new device identity likely invalidates ~/.wacli/session.db. Back up ~/.wacli/wacli.db (messages) first; only session.db changes.
5. Update skill skills/wacli-whatsapp.md for new flags (--account, --read-only, --lock-wait, --events) and new commands (messages forward, messages revoke, send status, calls list); check for command renames across 0.7–0.11.
6. Pin & track an upstream tag so the next 405 is a one-line version bump, not a silent auth-loss outage.