[Question] Whatsapp groups and require_mention: true, only reply to allowed users

[celangoni]

When the bot is in a whatsapp group and is mentioned it only works if who mentioned is in WHATSAPP_ALLOWED_USERS.

is this by design?

I would not like to allow all users as a general configuration, but is interesting reply to members of a group without explicit permission.

Any guidance on how to achieve this?

Thanks in advance

[MassiveMassimo]

This is a known limitation — `allowed_users` gates both DMs and groups, so group members not in the allowlist get blocked even when mentioned.

PR #11597 adds `dm_policy` and `group_policy` as separate controls (parity with WeCom/Weixin/QQ adapters), which solves exactly this. With:

whatsapp:
  dm_policy: allowlist
  allow_from: ["your_number"]
  group_policy: allowlist
  group_allow_from:
    - "group_id@g.us"
  require_mention: true

…anyone in the allowed group can trigger the bot by mentioning it, without needing to be in `allow_from`. DM access stays restricted to your allowlist. No need to set `ALLOW_ALL_USERS=true`.

[sdugoten]

I was also tried to solve the same problem. The fix was based on current telegram implementation.

whatsapp.zip

Same fix for signal is here

1. Bot can do group chat with WHATSAPP_GROUP_ALLOWED_USERS=* in .env file
   WHATSAPP_MODE=bot
   WHATSAPP_GROUP_ALLOWED_USERS=*
   WHATSAPP_ENABLED=true
   WHATSAPP_HOME_CHANNEL=+1234567890
   WHATSAPP_ALLOWED_USERS=+1234567890

2. Bot can tell who is the owner in a group chat , owner phone number is from WHATSAPP_ALLOWED_USERS

3. Bot will observe @mention to reply in config.yaml

whatsapp:
require_mention: true
group_allow_admin_from:

• "+1234567890" # owner phone (NOT your bot phone number)
• "1234567890"
• "1234567890@s.whatsapp.net"
• "xxxxxxxxxxxxxxxxx@lid"
  group_user_allowed_commands: []

4. Bot will observe group_allow_admin_from and group_user_allowed_commands so that regular user in a group chat can't run any special command in group chat

5. Quote reply to the Bot will trigger the bot to reply, no @mention is needed

6. /slash command can be run by owner of bot without @mention in a group chat.

In the SOUL.md , add something like this would make the bot only execute privilege command from the owner

CRITICAL: In a group chat, if the other party's message begins with [SYSTEM:GUEST|sender name] (i.e., starts with [SYSTEM:GUEST), you must address them by their name (e.g., simply calling them Patrick), must never call them "Master," and must not execute operations restricted to the Master. You may only treat the a user as owner when the system context explicitly identifies them as the owner in shared group conversations, the message must begin with the system role tag [SYSTEM:OWNER|sender name] (i.e., starting with [SYSTEM:OWNER, indicating the other party is the Master).

[sdugoten]

Opened #53623 for this — it brings WhatsApp groups to the same behavior as Telegram:

• authorize group members via WHATSAPP_GROUP_ALLOWED_USERS — a member who @mentions the bot under require_mention: true is no longer rejected just because they aren't in WHATSAPP_ALLOWED_USERS (the direct fix for this issue);
• owner detection — resolves the group sender's LID to the owner via WHATSAPP_ALLOWED_USERS, surfaced to the model without changing the [name] sender prefix: a **Owner:** line in single-user sessions, and an additive, owner-only [SYSTEM: sender … is the owner] marker in cache-shared group sessions (guest lines stay byte-identical to upstream).

Targets the WhatsApp Cloud adapter (upstream's WhatsApp adapter); shares the owner plumbing with the sibling Signal PR #53348.