@aunucore/baileys 1.0.84 → 1.0.86

package/lib/Socket/aunu-experimental.js

@@ -5,6 +5,10 @@ import { generateWAMessageFromContent, prepareWAMessageMedia } from '../Utils/me
 import { proto } from '../../WAProto/index.js';
 import { randomBytes } from 'crypto';
 const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+// AunuBaileys (1.0.86, HB-112 short series): Node clamps any
+// setTimeout delay above 2^31-1 ms (~24.8 days) down to 1 ms, so
+// a longer delay must be armed in slices of at most this size.
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
 /**
  * AunuBaileys EXPERIMENTAL socket features — these exist only in
  * AunuBaileys and may change or disappear in any release:
@@ -125,7 +129,8 @@ export const attachAunuExperimental = (sock) => {
     sock.aunuSchedule = (jid, content, when, options = {}) => {
         const at = when instanceof Date ? when.getTime() : Date.now() + Math.max(0, Number(when) || 0);
         const id = `aunu-sched-${++seq}`;
-        const timer = setTimeout(() => {
+        const entry = { jid, at, timer: undefined };
+        const fire = () => {
             scheduled.delete(id);
             // AunuBaileys (1.0.72): failures used to be swallowed by
             // an empty catch — a scheduled message that failed (socket
@@ -133,9 +138,23 @@ export const attachAunuExperimental = (sock) => {
             Promise.resolve(sock.sendMessage(jid, content, options)).catch((err) => {
                 logger?.warn?.({ err, jid, id }, 'aunu: scheduled message failed to send');
             });
-        }, Math.max(0, at - Date.now()));
-        timer.unref?.();
-        scheduled.set(id, { jid, at, timer });
+        };
+        // AunuBaileys (1.0.86, HB-112 short series): arm in slices.
+        // A single setTimeout for a send scheduled more than ~24.8
+        // days out used to be clamped by Node to 1 ms, so the
+        // message fired IMMEDIATELY and the entry vanished as if
+        // sent on schedule. entry.timer always holds the CURRENT
+        // slice's handle, so cancel and socket-end cleanup (which
+        // read entry.timer) keep working unchanged.
+        const arm = () => {
+            const remaining = at - Date.now();
+            entry.timer = remaining > MAX_TIMER_DELAY_MS
+                ? setTimeout(arm, MAX_TIMER_DELAY_MS)
+                : setTimeout(fire, Math.max(0, remaining));
+            entry.timer.unref?.();
+        };
+        arm();
+        scheduled.set(id, entry);
         return { id, at, cancel: () => sock.aunuCancelScheduled(id) };
     };
     sock.aunuCancelScheduled = (id) => {
@@ -152,14 +171,29 @@ export const attachAunuExperimental = (sock) => {
         const sent = await sock.sendMessage(jid, content, options);
         const key = sent?.key;
         if (key?.id) {
-            const timer = setTimeout(() => {
+            // AunuBaileys (1.0.86, HB-112 short series): same
+            // slice-arming as aunuSchedule — a self-destruct set
+            // more than ~24.8 days out used to be clamped by Node
+            // to 1 ms and deleted the message almost immediately
+            // after it was sent. The map always holds the current
+            // slice's handle, so cancel and socket-end cleanup are
+            // unchanged.
+            const fireAt = Date.now() + Math.max(0.05, Number(seconds) || 0) * 1000;
+            const fire = () => {
                 destructs.delete(key.id);
                 Promise.resolve(sock.sendMessage(jid, { delete: key })).catch((err) => {
                     logger?.warn?.({ err, jid, id: key.id }, 'aunu: self-destruct delete failed');
                 });
-            }, Math.max(0.05, Number(seconds) || 0) * 1000);
-            timer.unref?.();
-            destructs.set(key.id, timer);
+            };
+            const arm = () => {
+                const remaining = fireAt - Date.now();
+                const timer = remaining > MAX_TIMER_DELAY_MS
+                    ? setTimeout(arm, MAX_TIMER_DELAY_MS)
+                    : setTimeout(fire, Math.max(0, remaining));
+                timer.unref?.();
+                destructs.set(key.id, timer);
+            };
+            arm();
         }
         return sent;
     };

package/lib/Socket/chats.js

@@ -906,16 +906,33 @@ export const makeChatsSocket = (config) => {
             }
         }
         const historyMsg = getHistoryMsg(msg.message);
-        const shouldProcessHistoryMsg = historyMsg
+        // AunuBaileys (1.0.86, HB-113 short series): the
+        // shouldSyncHistoryMessage preference governs PASSIVE sync
+        // only. An ON_DEMAND payload is the answer to an explicit
+        // host request (fetchMessageHistory /
+        // requestPlaceholderResend); the single shared gate used
+        // to discard it silently whenever the preference was off
+        // — including the syncFullHistory:false default — so the
+        // host's request vanished without an error and without
+        // the messaging-history.set event. The initial-sync state
+        // machine below keeps the preference-based predicate
+        // (syncPreferenceAllows): on-demand responses must not
+        // drive it. For every non-ON_DEMAND input, and for
+        // ON_DEMAND with the preference on, syncPreferenceAllows
+        // equals the old gate exactly.
+        const syncPreferenceAllows = historyMsg
             ? shouldSyncHistoryMessage(historyMsg) && PROCESSABLE_HISTORY_TYPES.includes(historyMsg.syncType)
             : false;
+        const shouldProcessHistoryMsg = historyMsg?.syncType === proto.HistorySync.HistorySyncType.ON_DEMAND
+            ? true
+            : syncPreferenceAllows;
         // State machine: decide on sync and flush
         if (historyMsg && syncState === SyncState.AwaitingInitialSync) {
             if (awaitingSyncTimeout) {
                 clearTimeout(awaitingSyncTimeout);
                 awaitingSyncTimeout = undefined;
             }
-            if (shouldProcessHistoryMsg) {
+            if (syncPreferenceAllows) {
                 syncState = SyncState.Syncing;
                 logger.info('Transitioned to Syncing state');
                 // Let doAppStateSync handle the final flush after it's done

package/lib/Socket/messages-recv.js

@@ -1986,9 +1986,22 @@ export const makeMessagesRecvSocket = (config) => {
                     msg.messageStubType = call.isVideo ? WAMessageStubType.CALL_MISSED_VIDEO : WAMessageStubType.CALL_MISSED_VOICE;
                 }
             }
-            else {
+            else if (call.id) {
                 msg.message = { call: { callKey: Buffer.from(call.id) } };
             }
+            else {
+                // AunuBaileys (1.0.86, HB-216): a group call offer
+                // without a call-id (an optional stanza attr the
+                // decoder does not validate) made Buffer.from throw
+                // a raw TypeError inside this listener; the throw
+                // unwound the whole 'call' emit, so host listeners
+                // registered after this one never saw the offer at
+                // all. There is no call key to reference and the
+                // message key would carry no id either — skip the
+                // notification message; the 'call' event itself
+                // still reaches every listener.
+                return;
+            }
             const protoMsg = proto.WebMessageInfo.fromObject(msg);
             // AunuBaileys: this floated unawaited and uncaught — a
             // rejection here was an unhandledRejection that could kill

package/lib/Socket/messages-send.js

@@ -279,7 +279,17 @@ export const makeMessagesSocket = (config) => {
             try {
             const { recipientJid: jid, ...patchedMessage } = patchedMessageWithJid;
             if (!jid) {
-                return {};
+                // AunuBaileys (1.0.86, HB-136): this used to return
+                // {} — truthy, so it passed the filter below and
+                // counted as a SUCCESSFUL node. A patch whose every
+                // entry lacked a recipientJid therefore "sent" a
+                // stanza with an empty <participants> list and
+                // relayMessage resolved, instead of failing with
+                // 'All encryptions failed' (the encoder silently
+                // drops tag-less children, so the stanza really
+                // went out). Upstream returns null here — the same
+                // value the per-recipient catch below already uses.
+                return null;
             }
             const bytes = encodeWAMessage(patchedMessage);
             let encResult;

package/lib/Socket/newsletter.d.ts

@@ -22,7 +22,7 @@ export declare const makeNewsletterSocket: (sock: GroupsSocket) => {
     subscribeNewsletterUpdates: (jid: string) => Promise<{
         duration: string;
     } | null>;
-    newsletterAdminCount: (jid: string) => Promise<number>;
+    newsletterAdminCount: (jid: string) => Promise<number | undefined>;
     newsletterChangeOwner: (jid: string, newOwnerJid: string) => Promise<void>;
     newsletterDemote: (jid: string, userJid: string) => Promise<void>;
     newsletterDelete: (jid: string) => Promise<void>;

package/lib/Socket/newsletter.js

@@ -181,7 +181,13 @@ export const makeNewsletterSocket = (sock) => {
         },
         newsletterAdminCount: async (jid) => {
             const response = await executeWMexQuery({ newsletter_id: jid }, QueryIds.ADMIN_COUNT, XWAPaths.xwa2_newsletter_admin_count);
-            return response.admin_count;
+            // AunuBaileys (1.0.86, HB-111 short series): the guard in
+            // executeWMexQuery only rejects an UNDEFINED response —
+            // a GraphQL null for the admin path passes through
+            // verbatim, and this bare deref threw a raw TypeError at
+            // the host. A channel without admin info simply has no
+            // count to report.
+            return response?.admin_count;
         },
         newsletterChangeOwner: async (jid, newOwnerJid) => {
             await executeWMexQuery({ newsletter_id: jid, user_id: newOwnerJid }, QueryIds.CHANGE_OWNER, XWAPaths.xwa2_newsletter_change_owner);

package/lib/Store/make-in-memory-store.js

@@ -306,6 +306,13 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
         });
         ev.on('messages.reaction', (reactions) => {
             for (const { key, reaction } of reactions) {
+                // AunuBaileys (1.0.86, HB-187 addendum): a key-less
+                // reaction (host-emitted, or delivered unbuffered)
+                // dereferenced key.remoteJid bare here and threw
+                // inside the listener. It has no target; skip it.
+                if (!key?.remoteJid) {
+                    continue;
+                }
                 const obj = messages[key.remoteJid];
                 const msg = obj === null || obj === void 0 ? void 0 : obj.get(key.id);
                 if (msg) {

package/lib/Utils/event-buffer.js

@@ -100,7 +100,7 @@ export const makeEventBuffer = (logger) => {
                 delete data.chatUpdates[update.id];
             }
         }
-        const consolidatedData = consolidateEvents(data);
+        const consolidatedMaps = consolidateEvents(data);
         // AunuBaileys (1.0.81, HB-166 + HB-224): swap the fresh
         // buffer in BEFORE emitting, and guard the emit. The old
         // order assigned `data = newData` after the emit, so
@@ -116,12 +116,14 @@ export const makeEventBuffer = (logger) => {
         // paths (processNodeWithBuffer), where a throw became an
         // uncaught exception / unhandled rejection.
         data = newData;
-        if (Object.keys(consolidatedData).length) {
-            try {
-                ev.emit('event', consolidatedData);
-            }
-            catch (err) {
-                logger.error({ err }, 'error emitting flushed events');
+        for (const consolidatedData of consolidatedMaps) {
+            if (Object.keys(consolidatedData).length) {
+                try {
+                    ev.emit('event', consolidatedData);
+                }
+                catch (err) {
+                    logger.error({ err }, 'error emitting flushed events');
+                }
             }
         }
         logger.trace({ conditionalChatUpdatesLeft }, 'released buffered events');
@@ -433,6 +435,17 @@ eventData, logger) {
         case 'messages.reaction':
             const reactions = eventData;
             for (const { key, reaction } of reactions) {
+                // AunuBaileys (1.0.86, HB-187): a reaction whose
+                // target key is missing (an optional proto field)
+                // used to throw a raw TypeError inside
+                // stringifyMessageKey — inside upsertMessage, after
+                // the delivery receipt had already been sent, so
+                // the stanza ALSO earned a NACK 500 and the
+                // reaction was lost. A key-less reaction has no
+                // target to attach to; skip it.
+                if (!key) {
+                    continue;
+                }
                 const keyStr = stringifyMessageKey(key);
                 const existing = data.messageUpserts[keyStr];
                 if (existing) {
@@ -462,10 +475,15 @@ eventData, logger) {
             const groupUpdates = eventData;
             for (const update of groupUpdates) {
                 const id = update.id;
-                const groupUpdate = data.groupUpdates[id] || {};
-                if (!data.groupUpdates[id]) {
-                    data.groupUpdates[id] = Object.assign(groupUpdate, update);
-                }
+                // AunuBaileys (1.0.86, HB-176): a second update for
+                // the same group inside one buffer window used to
+                // be discarded whole — the merge only ran when no
+                // update was stored yet, so a subject change
+                // followed by a description change delivered only
+                // the subject and the store kept stale metadata.
+                // Merge into the stored update, like chats.update
+                // and contacts.update already do.
+                data.groupUpdates[id] = Object.assign(data.groupUpdates[id] || {}, update);
             }
             break;
         default:
@@ -507,6 +525,11 @@ eventData, logger) {
 }
 function consolidateEvents(data) {
     const map = {};
+    // AunuBaileys (1.0.86, HB-159): extra maps emitted right after
+    // the main one (see the messages.upsert grouping below). The
+    // common single-type case leaves this empty and behaviour is
+    // exactly what it was before.
+    const extraMaps = [];
     if (!data.historySets.empty) {
         map['messaging-history.set'] = {
             chats: Object.values(data.historySets.chats),
@@ -532,11 +555,40 @@ function consolidateEvents(data) {
     }
     const messageUpsertList = Object.values(data.messageUpserts);
     if (messageUpsertList.length) {
-        const type = messageUpsertList[0].type;
+        // AunuBaileys (1.0.86, HB-159): the whole batch used to
+        // take the FIRST message's type. A live 'notify' message
+        // buffered behind offline 'append' messages (the initial
+        // offline drain, or a history resync racing live traffic)
+        // was delivered as 'append' — the store never created its
+        // chat, the unread count vanished, and hosts that only act
+        // on 'notify' never saw a live message. Group by type
+        // instead: same-type batches keep the single consolidated
+        // event; a mixed batch emits one messages.upsert per type
+        // (the extra maps flush right after the main one), every
+        // message keeping its own type, in arrival order.
+        const messagesByType = new Map();
+        for (const entry of messageUpsertList) {
+            const list = messagesByType.get(entry.type);
+            if (list) {
+                list.push(entry.message);
+            }
+            else {
+                messagesByType.set(entry.type, [entry.message]);
+            }
+        }
+        const [firstType, ...otherTypes] = [...messagesByType.keys()];
         map['messages.upsert'] = {
-            messages: messageUpsertList.map(m => m.message),
-            type
+            messages: messagesByType.get(firstType),
+            type: firstType
         };
+        for (const type of otherTypes) {
+            extraMaps.push({
+                'messages.upsert': {
+                    messages: messagesByType.get(type),
+                    type
+                }
+            });
+        }
     }
     const messageUpdateList = Object.values(data.messageUpdates);
     if (messageUpdateList.length) {
@@ -566,7 +618,7 @@ function consolidateEvents(data) {
     if (groupUpdateList.length) {
         map['groups.update'] = groupUpdateList;
     }
-    return map;
+    return [map, ...extraMaps];
 }
 function concatChats(a, b) {
     if (b.unreadCount === null && // neutralize unread counter

package/lib/Utils/history.js

@@ -39,6 +39,17 @@ export const processHistoryMessage = (item) => {
                 delete chat.messages;
                 for (const item of msgs) {
                     const message = item.message;
+                    // AunuBaileys (1.0.86, HB-181): HistorySyncMsg.
+                    // message is an OPTIONAL proto field — a wrapper
+                    // carrying only msgOrderId decodes with message
+                    // === null, and the bare derefs below (starting
+                    // at message.key) threw a TypeError that cost
+                    // the WHOLE history chunk (every conversation
+                    // in the blob was NACKed and lost), not just the
+                    // empty entry. Skip the entry.
+                    if (!message) {
+                        continue;
+                    }
                     messages.push(message);
                     if (!chat.messages?.length) {
                         // keep only the most recent message in the chat array

package/lib/Utils/index.d.ts

@@ -13,6 +13,7 @@ export * from './auth-utils.js';
 export * from './baileys-event-stream.js';
 export * from './use-multi-file-auth-state.js';
 export * from './link-preview.js';
+export * from './safe-fetch.js';
 export * from './event-buffer.js';
 export * from './process-message.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/Utils/index.js

@@ -31,6 +31,7 @@ export * from './auth-utils.js';
 export * from './baileys-event-stream.js';
 export * from './use-multi-file-auth-state.js';
 export * from './link-preview.js';
+export * from './safe-fetch.js';
 export * from './event-buffer.js';
 export * from './process-message.js';
 //# sourceMappingURL=index.js.map

package/lib/Utils/link-preview.js

@@ -1,15 +1,71 @@
 import { prepareWAMessageMedia } from './messages.js';
-import { extractImageThumb, getHttpStream } from './messages-media.js';
+import { extractImageThumb } from './messages-media.js';
+import { readImageDimensions, safeHttpGet } from './safe-fetch.js';
 const THUMBNAIL_WIDTH_PX = 192;
+// AunuBaileys (1.0.85): everything in this module is fetched on behalf
+// of a REMOTE PAGE — the URL comes from message text and the og:image
+// from the fetched page itself — so all of it now goes through the
+// SSRF-safe fetch (lib/Utils/safe-fetch.js): non-public addresses are
+// refused at connect time (peer-supplied URLs used to be able to make
+// the host GET loopback / RFC1918 / cloud-metadata addresses), and
+// every response is size- and time-bounded. link-preview-js is used
+// for HTML parsing ONLY (getPreviewFromContent); it no longer
+// performs any network access, so the protections do not depend on
+// the installed link-preview-js version. This also closes HB-205:
+// the HTML body used to be read in full with no cap and no overall
+// timeout (the library's abort timer covered only time-to-headers).
+const MAX_HTML_BYTES = 1024 * 1024; // og: tags live in <head>; the rest is cut off
+const MAX_THUMBNAIL_BYTES = 5 * 1024 * 1024;
+const MAX_THUMBNAIL_PIXELS = 40000000; // refuse decompression bombs before the image library sees them
+const MAX_PREVIEW_TIMEOUT_MS = 30000;
+const HTMLISH = /^(text\/html|application\/xhtml\+xml|text\/xml|application\/xml)\b/i;
+/** Only these keys of the caller's fetchOpts are honoured now. */
+const transportOpts = (fetchOpts = {}) => ({
+    // Sanitised at the boundary: a finite positive timeout is honored
+    // (clamped to a sane preview ceiling), anything else gets the
+    // historical 3000 ms default.
+    timeout: typeof fetchOpts.timeout === 'number' && Number.isFinite(fetchOpts.timeout) && fetchOpts.timeout > 0
+        ? Math.min(fetchOpts.timeout, MAX_PREVIEW_TIMEOUT_MS)
+        : 3000,
+    headers: fetchOpts.headers,
+    // Explicit, host-controlled hooks only — never derived from
+    // message content: an opt-in for deployments that really want
+    // previews of intranet links, and resolver/policy overrides.
+    allowPrivateNetworks: fetchOpts.allowPrivateNetworks === true,
+    isBlocked: typeof fetchOpts.isBlockedAddress === 'function' ? fetchOpts.isBlockedAddress : undefined,
+    lookup: typeof fetchOpts.lookup === 'function' ? fetchOpts.lookup : undefined
+});
+const decodeBody = (body, contentType) => {
+    const charset = /charset=["']?([\w-]+)/i.exec(contentType || '')?.[1];
+    try {
+        return new TextDecoder(charset || 'utf-8').decode(body);
+    }
+    catch {
+        return new TextDecoder('utf-8').decode(body);
+    }
+};
+/** Fetches an og:image through the safe fetch, with byte + pixel bounds. */
+const fetchThumbnailBuffer = async (imageUrl, fetchOpts) => {
+    const res = await safeHttpGet(imageUrl, {
+        ...transportOpts(fetchOpts),
+        maxBytes: MAX_THUMBNAIL_BYTES,
+        onLimit: 'throw'
+    });
+    const dims = readImageDimensions(res.body);
+    if (dims && dims.width * dims.height > MAX_THUMBNAIL_PIXELS) {
+        throw new Error(`thumbnail dimensions ${dims.width}x${dims.height} exceed the safety limit`);
+    }
+    return res.body;
+};
 /** Fetches an image and generates a thumbnail for it */
-// AunuBaileys (1.0.72): an og:image only ever becomes a small JPEG —
-// cap the source download instead of buffering a hostile endless
-// stream in full (HB-89). getUrlInfo catches thumbnail errors and
-// degrades to no thumbnail.
-const MAX_THUMBNAIL_SOURCE_BYTES = 8 * 1024 * 1024;
 const getCompressedJpegThumbnail = async (url, { thumbnailWidth, fetchOpts }) => {
-    const stream = await getHttpStream(url, fetchOpts);
-    const result = await extractImageThumb(stream, thumbnailWidth, MAX_THUMBNAIL_SOURCE_BYTES);
+    // AunuBaileys (1.0.72): an og:image only ever becomes a small
+    // JPEG — cap the source download instead of buffering a hostile
+    // endless stream in full (HB-89). (1.0.85): the cap is now
+    // enforced by the safe fetch (5 MiB, throw) before the bytes
+    // reach the image library, and pixel bombs are refused up front.
+    const buffer = await fetchThumbnailBuffer(url, fetchOpts);
+    const result = await extractImageThumb(buffer, thumbnailWidth);
     return result;
 };
 /**
@@ -23,34 +79,22 @@ export const getUrlInfo = async (text, opts = {
     fetchOpts: { timeout: 3000 }
 }) => {
     try {
-        // retries
-        const retries = 0;
-        const maxRetry = 5;
-        const { getLinkPreview } = await import('link-preview-js');
+        const { getPreviewFromContent } = await import('link-preview-js');
         let previewLink = text;
         if (!text.startsWith('https://') && !text.startsWith('http://')) {
             previewLink = 'https://' + previewLink;
         }
-        const info = await getLinkPreview(previewLink, {
-            ...opts.fetchOpts,
-            followRedirects: 'follow',
-            handleRedirects: (baseURL, forwardedURL) => {
-                const urlObj = new URL(baseURL);
-                const forwardedURLObj = new URL(forwardedURL);
-                if (retries >= maxRetry) {
-                    return false;
-                }
-                if (forwardedURLObj.hostname === urlObj.hostname ||
-                    forwardedURLObj.hostname === 'www.' + urlObj.hostname ||
-                    'www.' + forwardedURLObj.hostname === urlObj.hostname) {
-                    retries + 1;
-                    return true;
-                }
-                else {
-                    return false;
-                }
-            },
-            headers: opts.fetchOpts
+        const res = await safeHttpGet(previewLink, {
+            ...transportOpts(opts.fetchOpts),
+            maxBytes: MAX_HTML_BYTES,
+            onLimit: 'truncate',
+            shouldReadBody: (_status, headers) => !headers['content-type'] || HTMLISH.test(headers['content-type'])
+        });
+        const contentType = res.headers['content-type'];
+        const info = await getPreviewFromContent({
+            url: res.url,
+            data: decodeBody(res.body, contentType),
+            headers: contentType ? { 'content-type': contentType } : {}
         });
         if (info && 'title' in info && info.title) {
             const [image] = info.images;
@@ -61,8 +105,16 @@ export const getUrlInfo = async (text, opts = {
                 description: info.description,
                 originalThumbnailUrl: image
             };
-            if (opts.uploadImage) {
-                const { imageMessage } = await prepareWAMessageMedia({ image: { url: image } }, {
+            if (opts.uploadImage && image) {
+                // AunuBaileys (1.0.85): the high-quality thumbnail is
+                // fetched through the safe fetch as a Buffer instead
+                // of handing the page-supplied URL to the generic
+                // media pipeline. The `&& image` guard also closes
+                // HB-150: a page without an og:image used to explode
+                // here with a raw TypeError and lose the whole
+                // preview.
+                const thumb = await fetchThumbnailBuffer(image, opts.fetchOpts);
+                const { imageMessage } = await prepareWAMessageMedia({ image: thumb }, {
                     upload: opts.uploadImage,
                     mediaTypeOverride: 'thumbnail-link',
                     options: opts.fetchOpts
@@ -87,4 +139,4 @@ export const getUrlInfo = async (text, opts = {
         }
     }
 };
-//# sourceMappingURL=link-preview.js.map
+//# sourceMappingURL=link-preview.js.map