@aunucore/baileys 1.0.83 → 1.0.84

package/lib/Socket/chats.js

@@ -1,4 +1,3 @@
-import NodeCache from '@cacheable/node-cache';
 import { Boom } from '@hapi/boom';
 import { proto } from '../../WAProto/index.js';
 import { DEFAULT_CACHE_TTLS, PROCESSABLE_HISTORY_TYPES } from '../Defaults/index.js';
@@ -6,6 +5,7 @@ import { ALL_WA_PATCH_NAMES } from '../Types/index.js';
 import { SyncState } from '../Types/State.js';
 import { chatModificationToAppPatch, decodePatches, decodeSyncdSnapshot, encodeSyncdPatch, extractSyncdPatches, generateProfilePicture, getHistoryMsg, newLTHashState, processSyncAction } from '../Utils/index.js';
 import { makeMutex } from '../Utils/make-mutex.js';
+import { makeBoundedTTLCache } from '../Utils/bounded-cache.js';
 import processMessage from '../Utils/process-message.js';
 import { getBinaryNodeChild, getBinaryNodeChildren, isJidUser, isLidUser, jidDecode, jidNormalizedUser, reduceBinaryNodeToDictionary, S_WHATSAPP_NET } from '../WABinary/index.js';
 import { USyncQuery, USyncUser } from '../WAUSync/index.js';
@@ -24,10 +24,16 @@ export const makeChatsSocket = (config) => {
     // Timeout for AwaitingInitialSync state
     let awaitingSyncTimeout;
     const placeholderResendCache = config.placeholderResendCache ||
-        new NodeCache({
-            stdTTL: DEFAULT_CACHE_TTLS.MSG_RETRY, // 1 hour
-            useClones: false
-        });
+        // AunuBaileys (1.0.84, HB-231): in the standard
+        // makeWASocket composition this factory runs BEFORE
+        // messages-recv creates its own default, and the
+        // write-back below means the instance created HERE is
+        // the one the whole receive path actually uses. It used
+        // to be a NodeCache with no size cap, silently shadowing
+        // the bounded default messages-recv intended ("bounded
+        // by default — a TTL alone lets these grow without
+        // limit"). Build the same bounded cache here.
+        makeBoundedTTLCache({ ttlSeconds: DEFAULT_CACHE_TTLS.MSG_RETRY, maxEntries: 1000 });
     if (!config.placeholderResendCache) {
         config.placeholderResendCache = placeholderResendCache;
     }

package/lib/Store/make-in-memory-store.js

@@ -1,7 +1,7 @@
 // AunuCore fork backport: in-memory store dari Baileys 6.6.0, dikonversi ke ESM untuk basis 6.7.x
 import KeyedDBModule from '@adiwajshing/keyed-db';
 const KeyedDB = KeyedDBModule.default || KeyedDBModule;
-import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { readFileSync, writeFileSync, existsSync, renameSync } from 'fs';
 import { proto } from '../../WAProto/index.js';
 import { DEFAULT_CONNECTION_CONFIG } from '../Defaults/index.js';
 import { LabelAssociationType } from '../Types/LabelAssociation.js';
@@ -131,6 +131,16 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
             for (const update of updates) {
                 if (contacts[update.id]) {
                     Object.assign(contacts[update.id], update);
+                    // AunuBaileys (1.0.84, HB-245): a picture
+                    // notification arrives as imgUrl 'changed' /
+                    // 'removed' — a sentinel, not a URL. Drop the
+                    // cached URL instead of storing the sentinel:
+                    // fetchImageUrl used to hand the literal string
+                    // 'changed' to the host as the avatar URL, and
+                    // writeToFile persisted the poison to disk.
+                    if (update.imgUrl === 'changed' || update.imgUrl === 'removed') {
+                        delete contacts[update.id].imgUrl;
+                    }
                 }
                 else {
                     logger.debug({ update }, 'got update for non-existant contact');
@@ -258,7 +268,18 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
             if (metadata) {
                 switch (action) {
                     case 'add':
-                        metadata.participants.push(...participants.map(id => ({ id, isAdmin: false, isSuperAdmin: false })));
+                        // AunuBaileys (1.0.84, HB-237): skip ids
+                        // that are already listed. The metadata is
+                        // usually populated by a fetch that already
+                        // contains the member, and a redelivery
+                        // replays the notification — both used to
+                        // push a duplicate entry every single time,
+                        // without bound.
+                        for (const participantId of participants) {
+                            if (!metadata.participants.some(p => p.id === participantId)) {
+                                metadata.participants.push({ id: participantId, isAdmin: false, isSuperAdmin: false });
+                            }
+                        }
                         break;
                     case 'demote':
                     case 'promote':
@@ -301,14 +322,43 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
         labelAssociations
     });
     const fromJSON = (json) => {
-        chats.upsert(...json.chats);
-        labelAssociations.upsert(...json.labelAssociations || []);
-        contactsUpsert(Object.values(json.contacts));
-        labelsUpsert(Object.values(json.labels || {}));
-        for (const jid in json.messages) {
+        // AunuBaileys (1.0.84, HB-134 + HB-142 + addenda): every
+        // stage — and every entry — is isolated. One poisoned
+        // message entry used to throw out of fromJSON mid-loop:
+        // that jid's remaining messages and EVERY later jid were
+        // silently lost on every boot, while the stages before
+        // the throw stayed applied and readFromFile logged
+        // "starting with an empty store" — a claim the state did
+        // not match. A missing/null contacts stage threw the
+        // same way (Object.values of undefined), and a poisoned
+        // contacts/labels entry aborted every stage after it.
+        // Wrong-typed stages now read as empty, unusable entries
+        // are skipped, and a bad message entry is caught per
+        // entry with a warning — the healthy remainder of the
+        // file always loads.
+        if (!json || typeof json !== 'object') {
+            return;
+        }
+        const entriesOf = (value) => (Array.isArray(value) ? value : []).filter(e => !!e && typeof e === 'object');
+        const valuesOf = (value) => (value && typeof value === 'object' ? Object.values(value) : []);
+        chats.upsert(...entriesOf(json.chats));
+        labelAssociations.upsert(...entriesOf(json.labelAssociations));
+        contactsUpsert(valuesOf(json.contacts).filter(c => !!c && typeof c === 'object' && typeof c.id === 'string'));
+        labelsUpsert(valuesOf(json.labels).filter(l => !!l && typeof l === 'object' && typeof l.id === 'string'));
+        const messageSets = json.messages && typeof json.messages === 'object' ? json.messages : {};
+        for (const jid in messageSets) {
+            const entries = messageSets[jid];
+            if (!Array.isArray(entries)) {
+                continue;
+            }
             const list = assertMessageList(jid);
-            for (const msg of json.messages[jid]) {
-                list.upsert(proto.WebMessageInfo.fromObject(msg), 'append');
+            for (const msg of entries) {
+                try {
+                    list.upsert(proto.WebMessageInfo.fromObject(msg), 'append');
+                }
+                catch (err) {
+                    logger.warn({ jid, err }, 'aunu: skipped an unreadable message entry while loading the store');
+                }
             }
         }
     };
@@ -329,6 +379,16 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
             const cursorKey = !!cursor ? ('before' in cursor ? cursor.before : cursor.after) : undefined;
             const cursorValue = cursorKey ? list.get(cursorKey.id) : undefined;
             let messages;
+            // AunuBaileys (1.0.84, HB-177): a count of 0 means
+            // "no messages" — the slicing below used
+            // slice(-count), and slice(-0) is slice(0), so
+            // loadMessages(jid, 0) returned the chat's ENTIRE
+            // history (and negative counts mis-sliced as well).
+            // Every other path in this function already resolves
+            // to []. An absent count keeps the legacy behaviour.
+            if (typeof count === 'number' && count <= 0) {
+                return [];
+            }
             if (list && mode === 'before' && (!cursorKey || cursorValue)) {
                 if (cursorValue) {
                     const msgIdx = list.array.findIndex(m => m.key.id === (cursorKey === null || cursorKey === void 0 ? void 0 : cursorKey.id));
@@ -386,7 +446,13 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
             if (!contact) {
                 return sock === null || sock === void 0 ? void 0 : sock.profilePictureUrl(jid);
             }
-            if (typeof contact.imgUrl === 'undefined') {
+            // AunuBaileys (1.0.84, HB-245): a store file written
+            // before this fix can still carry the 'changed' /
+            // 'removed' sentinel as imgUrl — treat it as no
+            // cached URL and fetch fresh; never hand a sentinel
+            // back as an avatar URL. A real cached URL is still
+            // returned as-is (and a fresh fetch re-caches it).
+            if (typeof contact.imgUrl === 'undefined' || contact.imgUrl === 'changed' || contact.imgUrl === 'removed') {
                 contact.imgUrl = await (sock === null || sock === void 0 ? void 0 : sock.profilePictureUrl(jid));
             }
             return contact.imgUrl;
@@ -419,7 +485,17 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
         writeToFile: (path) => {
             // require fs here so that in case "fs" is not available -- the app does not crash
             
-            writeFileSync(path, JSON.stringify(toJSON()));
+            // AunuBaileys (1.0.84, HB-120 + addendum): every
+            // other persistence writer in the lib is atomic and
+            // 0600 (auth files HB-116, the lid store); this one
+            // wrote the full chat/contact/message history
+            // world-readable AND non-atomically — a crash
+            // mid-write left a truncated file the next boot read
+            // as corrupt and discarded wholesale. Write a
+            // per-pid temp file, then rename it over the target.
+            const tmpPath = `${path}.tmp-${process.pid}`;
+            writeFileSync(tmpPath, JSON.stringify(toJSON()), { mode: 0o600 });
+            renameSync(tmpPath, path);
         },
         readFromFile: (path) => {
             // require fs here so that in case "fs" is not available -- the app does not crash

package/lib/Utils/auth-utils.js

@@ -16,11 +16,35 @@ export function makeCacheableSignalKeyStore(store, logger, _cache) {
         new NodeCache({
             stdTTL: DEFAULT_CACHE_TTLS.SIGNAL_STORE, // 5 minutes
             useClones: false,
-            deleteOnExpire: true
+            deleteOnExpire: true,
+            // AunuBaileys (1.0.84, HB-199): a TTL bounds an
+            // entry's AGE, not the entry COUNT — a burst of
+            // distinct sender addresses inside the 5-minute
+            // window grew this cache without limit (the exact
+            // warning written in bounded-cache.js). Cap the
+            // number of keys as well. NOTE: NodeCache's maxKeys
+            // does not evict — set() THROWS once the cap is hit —
+            // so every cache write below goes through cacheSet,
+            // which swallows that one error: the underlying store
+            // is authoritative, a skipped cache entry only costs
+            // a re-read, and the cap can never break a session
+            // operation.
+            maxKeys: 1000
         });
     function getUniqueId(type, id) {
         return `${type}.${id}`;
     }
+    // AunuBaileys (1.0.84, HB-199): see the maxKeys note above —
+    // a full cache must degrade to "not cached", never to a throw
+    // escaping into get()/set().
+    function cacheSet(key, value) {
+        try {
+            cache.set(key, value);
+        }
+        catch {
+            // cache is at its key cap; the store stays authoritative
+        }
+    }
     return {
         async get(type, ids) {
             const data = {};
@@ -41,7 +65,7 @@ export function makeCacheableSignalKeyStore(store, logger, _cache) {
                     const item = fetched[id];
                     if (item) {
                         data[id] = item;
-                        cache.set(getUniqueId(type, id), item);
+                        cacheSet(getUniqueId(type, id), item);
                     }
                 }
             }
@@ -67,7 +91,7 @@ export function makeCacheableSignalKeyStore(store, logger, _cache) {
                         cache.del(getUniqueId(type, id));
                     }
                     else {
-                        cache.set(getUniqueId(type, id), data[type][id]);
+                        cacheSet(getUniqueId(type, id), data[type][id]);
                     }
                     keys += 1;
                 }

package/lib/Utils/baileys-event-stream.js

@@ -1,6 +1,6 @@
 import EventEmitter from 'events';
 import { createReadStream } from 'fs';
-import { writeFile } from 'fs/promises';
+import { rename, writeFile } from 'fs/promises';
 import { createInterface } from 'readline';
 import { delay } from './generics.js';
 import { makeMutex } from './make-mutex.js';
@@ -13,13 +13,48 @@ export const captureEventStream = (ev, filename) => {
     const oldEmit = ev.emit;
     // write mutex so data is appended in order
     const writeMutex = makeMutex();
+    // AunuBaileys (1.0.84, HB-247): a creds.update payload is the
+    // full credential material (private noise / identity /
+    // signed-pre-key bytes, the adv secret). The capture below
+    // redacts it to the NAMES of the fields that changed, creates
+    // the file 0600, and rotates it to `<filename>.1` once per
+    // 10 MiB so a long-running debug capture cannot grow (or
+    // leak) without bound.
+    let capturedBytes = 0;
+    const MAX_CAPTURE_BYTES = 10 * 1024 * 1024;
     // monkey patch eventemitter to capture all events
     ev.emit = function (...args) {
-        const content = JSON.stringify({ timestamp: Date.now(), event: args[0], data: args[1] }) + '\n';
         const result = oldEmit.apply(ev, args);
+        let content;
+        try {
+            const data = args[0] === 'creds.update' && args[1] && typeof args[1] === 'object'
+                ? { redacted: 'creds.update payload withheld (credential material)', updatedFields: Object.keys(args[1]) }
+                : args[1];
+            content = JSON.stringify({ timestamp: Date.now(), event: args[0], data }) + '\n';
+        }
+        catch {
+            // AunuBaileys (1.0.84, HB-129 addendum): an
+            // unserialisable (circular) payload used to throw
+            // synchronously out of the patched emit — into
+            // whatever lib code had emitted the event — because
+            // the stringify ran before oldEmit. Serialisation now
+            // happens after the real emit, and a payload that
+            // cannot be serialised is simply not captured.
+            return result;
+        }
+        // AunuBaileys (1.0.84, HB-129): the mutex promise used to
+        // be discarded — a failed write (deleted directory, full
+        // disk, permissions) rejected with no handler attached
+        // and crashed the host process (Node >= 15 default). A
+        // debug capture must never take the host down with it.
         writeMutex.mutex(async () => {
-            await writeFile(filename, content, { flag: 'a' });
-        });
+            capturedBytes += Buffer.byteLength(content);
+            if (capturedBytes > MAX_CAPTURE_BYTES) {
+                capturedBytes = Buffer.byteLength(content);
+                await rename(filename, `${filename}.1`).catch(() => { });
+            }
+            await writeFile(filename, content, { flag: 'a', mode: 0o600 });
+        }).catch(() => { });
         return result;
     };
 };

package/lib/Utils/event-buffer.js

@@ -45,11 +45,25 @@ export const makeEventBuffer = (logger) => {
             // had to run. Log the error and keep dispatching the
             // remaining events of the batch; the event itself
             // still fired, with its payload unchanged.
-            try {
-                ev.emit(event, map[event]);
-            }
-            catch (err) {
-                logger.error({ err, event }, 'error in event listener — dispatch continues');
+            //
+            // AunuBaileys (1.0.84, HB-264): dispatch PER LISTENER.
+            // A single ev.emit stops at the first listener that
+            // throws, so every listener registered AFTER the
+            // thrower silently missed that emit — a throwing
+            // logging listener registered before the host's
+            // saveCreds made that credential update vanish.
+            // rawListeners returns the once-wrappers themselves,
+            // so once semantics are preserved, and each listener
+            // gets its own guard: a throw now costs only the
+            // listener that threw.
+            const listeners = ev.rawListeners(event);
+            for (const listener of listeners) {
+                try {
+                    listener.call(ev, map[event]);
+                }
+                catch (err) {
+                    logger.error({ err, event }, 'error in event listener — dispatch continues');
+                }
             }
         }
     });
@@ -65,6 +79,17 @@ export const makeEventBuffer = (logger) => {
         }
         logger.debug('Flushing event buffer');
         isBuffering = false;
+        // AunuBaileys (1.0.84, HB-130 + addendum): the history
+        // dedup set only has to live for ONE buffering session.
+        // It used to survive every flush (cleared only in
+        // destroy()), so a second history sync inside the same
+        // socket lifetime silently dropped every already-known
+        // chat — and every already-known message key, even when
+        // that message's content had changed: fresh unread
+        // counts and edits never reached the store. Dedup for
+        // THIS session's appends already happened above; the
+        // next session starts empty.
+        historyCache.clear();
         const newData = makeBufferData();
         const chatUpdates = Object.values(data.chatUpdates);
         let conditionalChatUpdatesLeft = 0;
@@ -305,7 +330,14 @@ eventData, logger) {
                     data.contactUpserts[contact.id] = upsert;
                 }
                 if (data.contactUpdates[contact.id]) {
-                    upsert = Object.assign(data.contactUpdates[contact.id], trimUndefined(contact));
+                    // AunuBaileys (1.0.84, HB-182): the pending
+                    // update merges INTO the upsert. The old
+                    // direction merged the contact into the pending
+                    // update object and then deleted that object —
+                    // the merged result went nowhere, and fields
+                    // only the update carried (notify, verifiedName)
+                    // silently vanished from the flushed upsert.
+                    Object.assign(upsert, data.contactUpdates[contact.id]);
                     delete data.contactUpdates[contact.id];
                 }
             }

package/lib/Utils/generics.js

@@ -46,7 +46,26 @@ export const BufferJSON = {
     reviver: (_, value) => {
         if (typeof value === 'object' && !!value && (value.buffer === true || value.type === 'Buffer')) {
             const val = value.data || value.value;
-            return typeof val === 'string' ? Buffer.from(val, 'base64') : Buffer.from(val || []);
+            if (typeof val === 'string') {
+                // AunuBaileys (1.0.84, HB-143): Node's base64
+                // decoder is lenient — it silently DROPS
+                // characters outside the alphabet, so a garbage
+                // or hand-mangled string in a creds/key file
+                // decoded to wrong-length, wrong-value key bytes
+                // with no error anywhere, and the corruption only
+                // surfaced later as baffling Curve / handshake
+                // failures. The replacer above only ever produces
+                // canonical base64; reject anything else loudly.
+                // Both in-tree readers contain the throw: the
+                // auth-state reader logs a corrupt file and starts
+                // clean, and the sender-key reader falls back to
+                // an empty (self-healing) record.
+                if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(val)) {
+                    throw new Error('BufferJSON: invalid base64 in serialized Buffer data');
+                }
+                return Buffer.from(val, 'base64');
+            }
+            return Buffer.from(val || []);
         }
         return value;
     }

package/lib/Utils/lid-store.js

@@ -169,7 +169,10 @@ export const makeLIDStore = (options = {}) => {
             // AunuBaileys (1.0.70): atomic tmp+rename — a crash mid-write
             // used to leave a truncated store file behind.
             const tmpPath = `${path}.tmp-${process.pid}`;
-            writeFileSync(tmpPath, JSON.stringify(Object.fromEntries(pnToLid)));
+            // AunuBaileys (1.0.84, HB-120): 0600, like the auth
+            // files (HB-116) — this file maps phone numbers to
+            // LIDs and must not land world-readable.
+            writeFileSync(tmpPath, JSON.stringify(Object.fromEntries(pnToLid)), { mode: 0o600 });
             renameSync(tmpPath, path);
         },
         loadFromFile: (path) => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aunucore/baileys",
   "type": "module",
-  "version": "1.0.83",
+  "version": "1.0.84",
   "description": "AunuBaileys — the self-healing WhatsApp Web API for Node.js. Bad MAC and \"2000 messages into the future\" errors repair themselves, LID and phone-number identities stay in sync, anti-ban is built in, pairing codes are custom — plus 29 experimental features no other Baileys fork ships: invisible watermarks, per-person tag-all cards, side-profile text, ghost mentions and more. ESM, CJS and full TypeScript types.",
   "keywords": [
     "whatsapp",