@codexverified/baileys 2.12.13 → 2.13.13

package/README.md

@@ -40,7 +40,7 @@ The package is maintained by **Codex** under the **CodexVerified** organization.
 | Property | Value |
 | --- | --- |
 | Package | `@codexverified/baileys` |
-| Version | `2.12.13` |
+| Version | `2.13.13` |
 | Runtime | Node.js 20 or newer |
 | Module format | ESM, with CommonJS compatibility where supported |
 | Type declarations | Included at `lib/index.d.ts` |
@@ -54,7 +54,7 @@ The package is maintained by **Codex** under the **CodexVerified** organization.
 | Method | Command | Notes |
 | --- | --- | --- |
 | From npm | `npm install @codexverified/baileys` | Standard install when published under your organization |
-| From local archive | `npm install ./codex-baileys-2.12.13.tgz` | Place the `.tgz` beside your application |
+| From local archive | `npm install ./codex-baileys-2.13.13.tgz` | Place the `.tgz` beside your application |
 | Source audit (no scripts) | `npm install --ignore-scripts` | Skips install hooks for local review |
 
 Both npm and archive installs use the same import name:

package/lib/Defaults/index.js

@@ -2,7 +2,7 @@ import { proto } from '../../WAProto/index.js';
 import { makeLibSignalRepository } from '../Signal/libsignal.js';
 import { Browsers } from '../Utils/browser-utils.js';
 import logger from '../Utils/logger.js';
-const version = [2, 3000, 1040735178];
+const version = [2, 3000, 1043857760];
 export const UNAUTHORIZED_CODES = [401, 403, 419];
 export const BIZ_BOT_SUPPORT_PAYLOAD = '{"version":1,"is_ai_message":true,"should_upload_client_logs":false,"should_show_system_message":false,"ticket_id":"7004947587700716","citation_items":[],"ticket_locale":"us"}';
 export const DEFAULT_ORIGIN = 'https://web.whatsapp.com';
@@ -48,13 +48,13 @@ export const DEFAULT_CONNECTION_CONFIG = {
     browser: Browsers.macOS('Chrome'),
     waWebSocketUrl: 'wss://web.whatsapp.com/ws/chat',
     connectTimeoutMs: 20000,
-    keepAliveIntervalMs: 15000,
+    keepAliveIntervalMs: 30000,
     logger: logger.child({ class: 'baileys' }),
     emitOwnEvents: true,
     defaultQueryTimeoutMs: 60000,
     customUploadHosts: [],
     retryRequestDelayMs: 250,
-    maxMsgRetryCount: 3,
+    maxMsgRetryCount: 5,
     fireInitQueries: true,
     auth: undefined,
     markOnlineOnConnect: true,
@@ -66,7 +66,7 @@ export const DEFAULT_CONNECTION_CONFIG = {
     shouldIgnoreJid: () => false,
     linkPreviewImageThumbnailWidth: 192,
     transactionOpts: { maxCommitRetries: 10, delayBetweenTriesMs: 3000 },
-    generateHighQualityLinkPreview: true,
+    generateHighQualityLinkPreview: false,
     enableAutoSessionRecreation: true,
     enableRecentMessageCache: true,
     options: {},

package/lib/Utils/history.js

@@ -1,5 +1,6 @@
 import { promisify } from 'util';
-import { inflate } from 'zlib';
+import { pipeline } from 'stream/promises';
+import { createInflate, inflate } from 'zlib';
 import { proto } from '../../WAProto/index.js';
 import { WAMessageStubType } from '../Types/index.js';
 import { isHostedLidUser, isHostedPnUser, isLidUser, isPnUser } from '../WABinary/index.js';
@@ -24,13 +25,13 @@ const extractPnFromMessages = (messages) => {
 };
 export const downloadHistory = async (msg, options) => {
     const stream = await downloadContentFromMessage(msg, 'md-msg-hist', { options });
-    const bufferArray = [];
-    for await (const chunk of stream) {
-        bufferArray.push(chunk);
-    }
-    let buffer = Buffer.concat(bufferArray);
-    // decompress buffer
-    buffer = await inflatePromise(buffer);
+    // Pipe the decrypted stream directly through zlib inflate to avoid
+    // allocating an additional intermediate compressed-data buffer.
+    const inflater = createInflate();
+    const chunks = [];
+    inflater.on('data', (chunk) => chunks.push(chunk));
+    await pipeline(stream, inflater);
+    const buffer = Buffer.concat(chunks);
     const syncData = proto.HistorySync.decode(buffer);
     return syncData;
 };
@@ -55,6 +56,7 @@ export const processHistoryMessage = (item, logger) => {
                 contacts.push({
                     id: chat.id,
                     name: chat.displayName || chat.name || chat.username || undefined,
+                    username: chat.username || undefined,
                     lid: chat.lidJid || chat.accountLid || undefined,
                     phoneNumber: chat.pnJid || undefined
                 });
@@ -95,7 +97,7 @@ export const processHistoryMessage = (item, logger) => {
                         });
                     }
                 }
-                chats.push({ ...chat });
+                chats.push(chat);
             }
             break;
         case proto.HistorySync.HistorySyncType.PUSH_NAME:
@@ -109,6 +111,7 @@ export const processHistoryMessage = (item, logger) => {
         contacts,
         messages,
         lidPnMappings,
+        pastParticipants: item.pastParticipants,
         syncType: item.syncType,
         progress: item.progress
     };
@@ -127,4 +130,4 @@ export const getHistoryMsg = (message) => {
     const normalizedContent = !!message ? normalizeMessageContent(message) : undefined;
     const anyHistoryMsg = normalizedContent?.protocolMessage?.historySyncNotification;
     return anyHistoryMsg;
-};
+};

package/lib/Utils/message-retry-manager.js

@@ -52,6 +52,13 @@ export class MessageRetryManager {
             ttlAutopurge: true,
             updateAgeOnGet: true
         }); // 15 minutes TTL
+        // Cache Signal base keys briefly so duplicate retry receipts can be
+        // recognized without repeatedly recreating an otherwise valid session.
+        this.baseKeys = new LRUCache({
+            max: 1024,
+            ttl: 15 * 60 * 1000,
+            ttlAutopurge: true
+        });
         this.pendingPhoneRequests = {};
         this.maxMsgRetryCount = 5;
         this.statistics = {
@@ -215,6 +222,7 @@ export class MessageRetryManager {
         this.messageKeyIndex.clear();
         this.sessionRecreateHistory.clear();
         this.retryCounters.clear();
+        this.baseKeys.clear();
         for (const messageId of Object.keys(this.pendingPhoneRequests)) {
             this.cancelPendingPhoneRequest(messageId);
         }
@@ -227,6 +235,24 @@ export class MessageRetryManager {
             phoneRequests: 0
         };
     }
+    saveBaseKey(addr, msgId, baseKey) {
+        this.baseKeys.set(`${addr}:${msgId}`, baseKey);
+    }
+    hasSameBaseKey(addr, msgId, baseKey) {
+        const stored = this.baseKeys.get(`${addr}:${msgId}`);
+        if (!stored || stored.length !== baseKey.length) {
+            return false;
+        }
+        for (let i = 0; i < stored.length; i++) {
+            if (stored[i] !== baseKey[i]) {
+                return false;
+            }
+        }
+        return true;
+    }
+    deleteBaseKey(addr, msgId) {
+        this.baseKeys.delete(`${addr}:${msgId}`);
+    }
     keyToString(key) {
         return `${key.to}${MESSAGE_KEY_SEPARATOR}${key.id}`;
     }
@@ -238,4 +264,4 @@ export class MessageRetryManager {
         this.recentMessagesMap.delete(keyStr);
         this.messageKeyIndex.delete(messageId);
     }
-}
+}

package/lib/Utils/process-message.js

@@ -5,6 +5,7 @@ import { areJidsSameUser, isHostedLidUser, isHostedPnUser, isJidBroadcast, isJid
 import { aesDecryptGCM, hmacSign } from './crypto.js';
 import { getKeyAuthor, toNumber } from './generics.js';
 import { downloadAndProcessHistorySyncNotification } from './history.js';
+import { buildMergedTcTokenIndexWrite, resolveTcTokenJid } from './tc-token-utils.js';
 const REAL_MSG_STUB_TYPES = new Set([
     WAMessageStubType.CALL_MISSED_GROUP_VIDEO,
     WAMessageStubType.CALL_MISSED_GROUP_VOICE,
@@ -12,6 +13,52 @@ const REAL_MSG_STUB_TYPES = new Set([
     WAMessageStubType.CALL_MISSED_VOICE
 ]);
 const REAL_MSG_REQ_ME_STUB_TYPES = new Set([WAMessageStubType.GROUP_PARTICIPANT_ADD]);
+async function storeTcTokensFromHistorySync(chats, signalRepository, keyStore, logger) {
+    const getLIDForPN = signalRepository.lidMapping.getLIDForPN.bind(signalRepository.lidMapping);
+    const candidates = [];
+    for (const chat of chats || []) {
+        const ts = chat.tcTokenTimestamp ? toNumber(chat.tcTokenTimestamp) : 0;
+        if (chat.tcToken?.length && ts > 0) {
+            const jid = jidNormalizedUser(chat.id);
+            const storageJid = await resolveTcTokenJid(jid, getLIDForPN);
+            candidates.push({
+                storageJid,
+                token: Buffer.from(chat.tcToken),
+                ts,
+                senderTs: chat.tcTokenSenderTimestamp ? toNumber(chat.tcTokenSenderTimestamp) : undefined
+            });
+        }
+    }
+    if (!candidates.length) {
+        return;
+    }
+    const jids = candidates.map(candidate => candidate.storageJid);
+    const existing = await keyStore.get('tctoken', jids);
+    const entries = {};
+    for (const candidate of candidates) {
+        const existingEntry = existing[candidate.storageJid];
+        const existingTs = existingEntry?.timestamp ? Number(existingEntry.timestamp) : 0;
+        if (existingTs > 0 && existingTs >= candidate.ts) {
+            continue;
+        }
+        entries[candidate.storageJid] = {
+            ...existingEntry,
+            token: candidate.token,
+            timestamp: String(candidate.ts),
+            ...(candidate.senderTs !== undefined ? { senderTimestamp: candidate.senderTs } : {})
+        };
+    }
+    if (Object.keys(entries).length) {
+        logger?.debug({ count: Object.keys(entries).length }, 'storing tctokens from history sync');
+        try {
+            const indexWrite = await buildMergedTcTokenIndexWrite(keyStore, Object.keys(entries));
+            await keyStore.set({ tctoken: { ...entries, ...indexWrite } });
+        }
+        catch (err) {
+            logger?.warn({ err }, 'failed to store tctokens from history sync');
+        }
+    }
+}
 /** Cleans a received message to further processing */
 export const cleanMessage = (message, meId, meLid) => {
     // ensure remoteJid and participant doesn't have device or agent in it
@@ -146,6 +193,22 @@ const processMessage = async (message, { shouldProcessHistoryMsg, placeholderRes
     }
     const protocolMsg = content?.protocolMessage;
     if (protocolMsg) {
+        // These protocol messages are generated by the user’s primary device and
+        // must not be accepted from an arbitrary remote sender. Other protocol
+        // types, such as revokes and edits, legitimately originate from peers.
+        const SELF_ONLY_TYPES = new Set([
+            proto.Message.ProtocolMessage.Type.HISTORY_SYNC_NOTIFICATION,
+            proto.Message.ProtocolMessage.Type.APP_STATE_SYNC_KEY_SHARE,
+            proto.Message.ProtocolMessage.Type.LID_MIGRATION_MAPPING_SYNC,
+            proto.Message.ProtocolMessage.Type.PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE
+        ]);
+        if (protocolMsg.type !== null &&
+            protocolMsg.type !== undefined &&
+            SELF_ONLY_TYPES.has(protocolMsg.type) &&
+            !message.key.fromMe) {
+            logger?.warn({ msgId: message.key.id, type: protocolMsg.type, from: message.key.participant || message.key.remoteJid }, 'dropping spoofed self-only protocolMessage from non-self origin');
+            return;
+        }
         switch (protocolMsg.type) {
             case proto.Message.ProtocolMessage.Type.HISTORY_SYNC_NOTIFICATION:
                 const histNotification = protocolMsg.historySyncNotification;
@@ -174,6 +237,7 @@ const processMessage = async (message, { shouldProcessHistoryMsg, placeholderRes
                             .storeLIDPNMappings(data.lidPnMappings)
                             .catch(err => logger?.warn({ err }, 'failed to store LID-PN mappings from history sync'));
                     }
+                    await storeTcTokensFromHistorySync(data.chats, signalRepository, keyStore, logger);
                     ev.emit('messaging-history.set', {
                         ...data,
                         isLatest: histNotification.syncType !== proto.HistorySync.HistorySyncType.ON_DEMAND ? isLatest : undefined,
@@ -383,12 +447,19 @@ const processMessage = async (message, { shouldProcessHistoryMsg, placeholderRes
             id: jid,
             author: message.key.participant,
             authorPn: message.key.participantAlt,
+            authorUsername: message.key.participantUsername,
             participants,
             action
         });
         const emitGroupUpdate = (update) => {
             ev.emit('groups.update', [
-                { id: jid, ...update, author: message.key.participant ?? undefined, authorPn: message.key.participantAlt }
+                {
+                    id: jid,
+                    ...update,
+                    author: message.key.participant ?? undefined,
+                    authorPn: message.key.participantAlt,
+                    authorUsername: message.key.participantUsername
+                }
             ]);
         };
         const emitGroupRequestJoin = (participant, action, method) => {
@@ -396,6 +467,7 @@ const processMessage = async (message, { shouldProcessHistoryMsg, placeholderRes
                 id: jid,
                 author: message.key.participant,
                 authorPn: message.key.participantAlt,
+                authorUsername: message.key.participantUsername,
                 participant: participant.lid,
                 participantPn: participant.pn,
                 action,
@@ -524,4 +596,4 @@ const processMessage = async (message, { shouldProcessHistoryMsg, placeholderRes
         ev.emit('chats.update', [chat]);
     }
 };
-export default processMessage;
+export default processMessage;

package/lib/Utils/tc-token-utils.js

@@ -102,7 +102,8 @@ export async function buildTcTokenFromJid({ authState, jid, baseContent = [], ge
         const tcTokenData = await authState.keys.get('tctoken', [storageJid]);
         const entry = tcTokenData?.[storageJid];
         const tcTokenBuffer = entry?.token;
-        if (!tcTokenBuffer?.length || isTcTokenExpired(entry?.timestamp)) {
+        const timestamp = entry?.timestamp;
+        if (!tcTokenBuffer?.length || timestamp === undefined || isTcTokenExpired(timestamp)) {
             if (tcTokenBuffer) {
                 // Preserve senderTimestamp so shouldSendNewTcToken() keeps its dedupe state
                 // after we drop the unusable peer token. Only wipe the record entirely when
@@ -116,7 +117,7 @@ export async function buildTcTokenFromJid({ authState, jid, baseContent = [], ge
         }
         baseContent.push({
             tag: 'tctoken',
-            attrs: {},
+            attrs: { t: String(timestamp) },
             content: tcTokenBuffer
         });
         return baseContent;

package/lib/Utils/use-multi-file-auth-state.js

@@ -1,5 +1,5 @@
 import { Mutex } from 'async-mutex';
-import { mkdir, readFile, stat, unlink, writeFile } from 'fs/promises';
+import { mkdir, readFile, rename, stat, unlink, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { proto } from '../../WAProto/index.js';
 import { initAuthCreds } from './auth-utils.js';
@@ -31,10 +31,14 @@ export const useMultiFileAuthState = async (folder) => {
         const filePath = join(folder, fixFileName(file));
         const mutex = getFileLock(filePath);
         return mutex.acquire().then(async (release) => {
+            const tempPath = `${filePath}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`;
             try {
-                await writeFile(filePath, JSON.stringify(data, BufferJSON.replacer));
+                const serialized = JSON.stringify(data, BufferJSON.replacer);
+                await writeFile(tempPath, serialized, { encoding: 'utf8', mode: 0o600 });
+                await rename(tempPath, filePath);
             }
             finally {
+                await unlink(tempPath).catch(() => undefined);
                 release();
             }
         });
@@ -81,7 +85,7 @@ export const useMultiFileAuthState = async (folder) => {
         }
     }
     else {
-        await mkdir(folder, { recursive: true });
+        await mkdir(folder, { recursive: true, mode: 0o700 });
     }
     const fixFileName = (file) => file?.replace(/\//g, '__')?.replace(/:/g, '-');
     const creds = (await readData('creds.json')) || initAuthCreds();
@@ -117,4 +121,4 @@ export const useMultiFileAuthState = async (folder) => {
             return writeData(creds, 'creds.json');
         }
     };
-};
+};

package/lib/Utils/validate-connection.js

@@ -28,7 +28,7 @@ const getUserAgent = (config) => {
 };
 const PLATFORM_MAP = {
     'Mac OS': proto.ClientPayload.WebInfo.WebSubPlatform.DARWIN,
-    Windows: proto.ClientPayload.WebInfo.WebSubPlatform.WIN32
+    Windows: proto.ClientPayload.WebInfo.WebSubPlatform.WIN_HYBRID
 };
 const getWebInfo = (config) => {
     let webSubPlatform = proto.ClientPayload.WebInfo.WebSubPlatform.WEB_BROWSER;
@@ -48,6 +48,9 @@ const getClientPayload = (config) => {
     if (!config.browser[1].toLocaleLowerCase().includes('android')) {
         payload.webInfo = getWebInfo(config);
     }
+    if (config.pushName) {
+        payload.pushName = config.pushName;
+    }
     return payload;
 };
 export const generateLoginNode = (userJid, config) => {
@@ -203,4 +206,4 @@ export const encodeSignedDeviceIdentity = (account, includeSignatureKey) => {
         account.accountSignatureKey = null;
     }
     return proto.ADVSignedDeviceIdentity.encode(account).finish();
-};
+};

package/package.json

@@ -1,6 +1,6 @@
 {
    "name": "@codexverified/baileys",
-   "version": "2.12.13",
+   "version": "2.13.13",
    "description": "CODEX TECHNOLOGY  a premium Baileys developed and built by Dev Codex, with Meta compositing, bot planning replay, welcome flow, rich messages, interactive messages, albums, and more.",
    "main": "lib/index.js",
    "type": "module",