Low-priority items from the 2026-06-12 deep review, verified but deliberately not rushed into the hardening batch (#31):
-
Media handlers discard w.Write errors and pre-set 24h cache — internal/web/api.go /api/media/ and /api/whatsapp/avatar handlers set Cache-Control: public, max-age=86400 before writing and ignore the write error, so a truncated body can be cached for a day by the browser. Check the platform fetch fully succeeded before setting cache headers; log dropped writes.
-
render_story / generate_viz accept arbitrary output_path / photo_paths — internal/tools/render_story.go writes caller-named paths and reads caller-named files. This is by design for story exports, and MCP runs with operator trust behind the loopback guard + injection preamble — but a prompt-injected agent could be steered into writing HTML to e.g. ~/Library/LaunchAgents/. Consider confining writes to ~/Documents/OpenMessage/ (or an OPENMESSAGES_EXPORT_DIR) with an explicit env escape hatch, mirroring how download_media confines to the temp dir.
-
Second read-only SQLite handle on whatsmeow's live session DB — internal/whatsapplive/client.go (lookupPN/LIDFromSessionStore) opens whatsapp-session.db read-only per call on the message hot path while whatsmeow holds it for writes. WAL+ro is normally fine; worth a comment documenting the cross-handle dependency and a cached handle instead of open/close per lookup.
Low-priority items from the 2026-06-12 deep review, verified but deliberately not rushed into the hardening batch (#31):
Media handlers discard
w.Writeerrors and pre-set 24h cache —internal/web/api.go/api/media/and/api/whatsapp/avatarhandlers setCache-Control: public, max-age=86400before writing and ignore the write error, so a truncated body can be cached for a day by the browser. Check the platform fetch fully succeeded before setting cache headers; log dropped writes.render_story/generate_vizaccept arbitraryoutput_path/photo_paths—internal/tools/render_story.gowrites caller-named paths and reads caller-named files. This is by design for story exports, and MCP runs with operator trust behind the loopback guard + injection preamble — but a prompt-injected agent could be steered into writing HTML to e.g.~/Library/LaunchAgents/. Consider confining writes to~/Documents/OpenMessage/(or anOPENMESSAGES_EXPORT_DIR) with an explicit env escape hatch, mirroring howdownload_mediaconfines to the temp dir.Second read-only SQLite handle on whatsmeow's live session DB —
internal/whatsapplive/client.go(lookupPN/LIDFromSessionStore) openswhatsapp-session.dbread-only per call on the message hot path while whatsmeow holds it for writes. WAL+ro is normally fine; worth a comment documenting the cross-handle dependency and a cached handle instead of open/close per lookup.