@c4t4/heyamigo 0.8.5 → 0.8.7

package/dist/gateway/incoming.js

@@ -1,3 +1,4 @@
+import { unlink } from 'fs/promises';
 import { getContentType, isJidGroup, jidDecode, jidNormalizedUser, } from 'baileys';
 import { getSession } from '../ai/sessions.js';
 import { config } from '../config.js';
@@ -77,15 +78,30 @@ async function processMessages(messages, sock, ownerJid, isHistorySync = false)
                 const size = getMediaSize(msg);
                 if (size !== null && size > limits.maxFileBytes) {
                     await append(stored);
-                    const mb = (limits.maxFileBytes / (1024 * 1024)).toFixed(1);
                     const quoted = isGroup && config.reply.quoteInGroups ? msg : undefined;
-                    await sendText(sock, stored.jid, `File too large (max ${mb} MB). I can't read this one — try a smaller version.`, quoted).catch((err) => logger.error({ err, jid: stored.jid }, 'failed to send oversized-file notice'));
+                    await sendText(sock, stored.jid, 'Could not process that, please try a smaller file.', quoted).catch((err) => logger.error({ err, jid: stored.jid }, 'failed to send oversized-file notice'));
                     logger.info({ ...logCtx, size, cap: limits.maxFileBytes }, 'oversized media rejected');
                     continue;
                 }
             }
             // Download media if present (image, video, audio, document)
             const media = await downloadAndSave(msg, stored.jid);
+            // Post-download safety net: re-check against the real buffer size.
+            // Catches cases the pre-download gate missed — protobuf fileLength
+            // missing, nested in documentWithCaptionMessage, stickers, etc.
+            // Only enforced when we'd otherwise respond; silent groups keep the
+            // archive intact regardless of size.
+            if (media &&
+                limits.maxFileBytes !== null &&
+                decision.respond &&
+                media.bytes > limits.maxFileBytes) {
+                await unlink(media.mediaPath).catch(() => undefined);
+                await append(stored);
+                const quoted = isGroup && config.reply.quoteInGroups ? msg : undefined;
+                await sendText(sock, stored.jid, 'Could not process that, please try a smaller file.', quoted).catch((err) => logger.error({ err, jid: stored.jid }, 'failed to send oversized-file notice'));
+                logger.info({ ...logCtx, bytes: media.bytes, cap: limits.maxFileBytes }, 'oversized media rejected (post-download)');
+                continue;
+            }
             if (media) {
                 stored.mediaType = media.mediaType;
                 stored.mediaPath = media.mediaPath;

package/dist/store/media.js

@@ -98,6 +98,7 @@ export async function downloadAndSave(msg, jid) {
             mediaType,
             mediaPath: filePath,
             mediaMime: mimetype,
+            bytes: buffer.length,
         };
     }
     catch (err) {

package/dist/wa/whitelist.js

@@ -99,6 +99,29 @@ function load() {
     const content = readFileSync(ACCESS_FILE, 'utf-8');
     return AccessSchema.parse(JSON.parse(content));
 }
+// Per-field merge: access.json's role definition overrides individual fields
+// of DEFAULT_ROLES, instead of replacing the whole role object. This means
+// adding new role fields (maxFileBytes, dailyTokenLimit, …) in code stays
+// effective for existing installs whose access.json predates those fields.
+function resolveRoles() {
+    const configured = current.roles ?? {};
+    const out = {};
+    const names = new Set([
+        ...Object.keys(DEFAULT_ROLES),
+        ...Object.keys(configured),
+    ]);
+    for (const name of names) {
+        const def = DEFAULT_ROLES[name];
+        const cfg = configured[name];
+        if (def && cfg)
+            out[name] = { ...def, ...cfg };
+        else if (cfg)
+            out[name] = cfg;
+        else if (def)
+            out[name] = def;
+    }
+    return out;
+}
 function save(next) {
     writeFileSync(ACCESS_FILE, JSON.stringify(next, null, 2) + '\n', 'utf-8');
     current = next;
@@ -128,7 +151,7 @@ export function canSendProactive(jid) {
 }
 export function getRole(senderNumber) {
     const users = current.users ?? {};
-    const roles = { ...DEFAULT_ROLES, ...(current.roles ?? {}) };
+    const roles = resolveRoles();
     const entry = users[senderNumber];
     if (entry) {
         const roleName = entry.role;
@@ -154,7 +177,7 @@ export function getRole(senderNumber) {
 }
 export function getRoleForContext(senderNumber, isGroup) {
     const users = current.users ?? {};
-    const roles = { ...DEFAULT_ROLES, ...(current.roles ?? {}) };
+    const roles = resolveRoles();
     const entry = users[senderNumber];
     if (entry) {
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c4t4/heyamigo",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "description": "WhatsApp AI bot powered by Claude with long-term memory, browser control, and role-based access",
   "type": "module",
   "main": "dist/index.js",