@manybot/manybot 5.5.3 → 5.6.0

package/README.md

@@ -17,10 +17,14 @@ Open-source framework for message automation, extensible via community plugins.
 ## Requirements
 
 - Node.js >= 24
-- npm
+- npm >= 9
+- Go >= 1.23 (for whatsmeow driver)
+- protoc (for protobuf codegen)
 
 ## Getting started
 
+### Install from npm
+
 ```bash
 npm install -g @manybot/manybot
 npm install -g @manybot/manyplug
@@ -29,6 +33,16 @@ manybot
 
 On first run, a configuration file is created at `~/.manybot/manybot.toml`. Edit it to set up your preferences.
 
+### Develop from source
+
+```bash
+git clone <repo-url>
+cd dev
+npm install
+go build -o whatsmeow-service/bin/whatsmeow-service ./whatsmeow-service
+npm start
+```
+
 For detailed setup instructions, see the **[documentation](https://manybot.org/docs/)**.
 
 ## Plugins

package/dist/client/cache.js

@@ -5,7 +5,7 @@
  *
  * Why: an already-linked WhatsApp session doesn't get a full history
  * resync on reconnect — only a partial, non-deterministic slice of it
- * (see drivers/whatsapp/index.ts). Each fresh process starts with an
+ * (see drivers/baileys/index.ts). Each fresh process starts with an
  * empty in-memory store, so without a cache, chats seen in a previous
  * run can silently disappear from the current one.
  *

package/dist/client/store.js

@@ -8,6 +8,15 @@
  *   - chat names (for display and for building WAChat adapters)
  *   - contact names / notify (pushname) (for ctx.contacts)
  *   - messages by JID + ID (for poll vote decryption)
+ *
+ * PR1 of the whatsmeow-fallback refactor (see AUDIT_BAILEYS_LEAK.md):
+ * this module no longer imports from `@whiskeysockets/baileys`. The
+ * Baileys-specific shapes (WAMessage, Chat, Contact) are re-exported
+ * from src/drivers/baileys/sdk/baileysSock.ts as the driver-local
+ * aliases RawMessage, RawChat, RawContact — the rest of the codebase
+ * (this module included) sees only those neutral names, so the
+ * @whiskeysockets/baileys import line never leaks past the driver
+ * boundary.
  */
 // ── Factory ───────────────────────────────────────────────────────────────────
 /**
@@ -36,6 +45,8 @@ export function createStore() {
     // Max messages kept per chat (prevents unbounded memory growth)
     const MAX_MSGS_PER_CHAT = 200;
     function upsertChat(chat) {
+        if (!chat.id)
+            return;
         const name = chat.name ?? chat.id.split("@")[0];
         chatsMap.set(chat.id, { id: chat.id, name });
     }

package/dist/config.js

@@ -198,32 +198,136 @@ function detectSystemLang() {
 const DEFAULT_TOML_EN = `# ManyBot configuration file
 # See https://manybot.org/docs/config to learn more
 
-CLIENT_ID    = "manybot"
-CMD_PREFIX   = "!"
-CHATS        = []
-LANGUAGE     = "en"
-PHONE_NUMBER = ""
+CLIENT_ID     = "manybot"
+CMD_PREFIX    = "!"
+CHATS         = []
+EXCLUDE_CHATS = []
+LANGUAGE      = "en"
+PHONE_NUMBER  = ""
+
+# How cautious the bot is about looking automated: "low", "medium", "high".
+# Higher levels slow the bot down (fewer concurrent chats, longer delays)
+# but reduce the risk of WhatsApp flagging the account.
+SECURITY_LEVEL = "medium"
+
+# ── Local alerts (critical warnings, update notices) ──────────────────────
+# Phone number (or full JID) that receives WhatsApp alerts when the bot
+# itself is up — e.g. "5511999999999" or "5511999999999@s.whatsapp.net".
+# Leave blank to disable this sink (the log file and OS notification still
+# work even if the bot is down or restricted).
+ADMIN_JID = ""
+
+# SMTP is optional — leave SMTP_HOST blank to disable the email sink.
+# SMTP_SEC: "starttls" (port 587, upgrades after connecting — most
+# providers), "ssl" (port 465, encrypted from the start), or "none".
+SMTP_HOST = ""
+SMTP_PORT = 587
+SMTP_SEC  = "starttls"
+SMTP_USER = ""
+SMTP_PASS = ""
+SMTP_FROM = ""
+SMTP_TO   = ""
+# Skip TLS certificate validation. Needed for local SMTP proxies with a
+# self-signed cert — e.g. Proton Mail Bridge (127.0.0.1), Mailhog,
+# Mailpit. Leave false for a real remote mail provider.
+SMTP_INSECURE = false
+
+# Checks npm for a newer manybot version: on startup, then every
+# UPDATE_CHECK_INTERVAL_HOURS.
+UPDATE_CHECK_ENABLED       = true
+UPDATE_CHECK_INTERVAL_HOURS = 24
 
 # How to connect the first time: "qr" (scan with WhatsApp on your phone)
 # or "phone" (receive a pairing code on the number set in PHONE_NUMBER).
 # Leave blank to choose interactively on first run — the choice is then
 # saved here automatically.
 LOGIN_METHOD = ""
+
+# ── Status page ────────────────────────────────────────────────────────────
+# Local HTTP page showing whether the bot is online or offline.
+STATUS_ENABLED = true
+STATUS_PORT    = 8080
+
+# ── Driver selection (advanced) ────────────────────────────────────────────
+# ManyBot can fall back from a primary driver to a secondary one when the
+# primary fails to confirm a send. Today only Baileys is wired in; leave
+# driver_whatsmeow_enabled = false to disable the fallback entirely (no
+# extra processes are spawned, no sockets are opened).
+driver_primary = "baileys"
+driver_fallback_cooldown_ms = 60000
+driver_verify_window_ms = [500, 1000, 1500, 2500, 5000]
+driver_baileys_enabled = true
+driver_whatsmeow_enabled = false
+driver_whatsmeow_grpc_address = "localhost:50051"
+driver_whatsmeow_binary_path = ""
 `;
 const DEFAULT_TOML_PT = `# Arquivo de configuração do ManyBot
 # Veja https://manybot.org/docs/config para saber mais
 
-CLIENT_ID    = "manybot"
-CMD_PREFIX   = "!"
-CHATS        = []
-LANGUAGE     = "pt"
-PHONE_NUMBER = ""
+CLIENT_ID     = "manybot"
+CMD_PREFIX    = "!"
+CHATS         = []
+EXCLUDE_CHATS = []
+LANGUAGE      = "pt"
+PHONE_NUMBER  = ""
+
+# Quão cauteloso o bot é pra não parecer automatizado: "low", "medium", "high".
+# Níveis mais altos deixam o bot mais lento (menos chats simultâneos, atrasos
+# maiores), mas reduzem o risco do WhatsApp sinalizar a conta.
+SECURITY_LEVEL = "medium"
+
+# ── Avisos locais (alertas críticos, aviso de update) ──────────────────────
+# Número de telefone (ou JID completo) que recebe alertas via WhatsApp
+# quando o bot está de pé — ex. "5511999999999" ou
+# "5511999999999@s.whatsapp.net". Deixe em branco pra desligar esse canal
+# (o log e a notificação do SO continuam funcionando mesmo com o bot
+# caído ou restrito).
+ADMIN_JID = ""
+
+# SMTP é opcional — deixe SMTP_HOST em branco pra desligar o canal de e-mail.
+# SMTP_SEC: "starttls" (porta 587, atualiza a conexão depois de
+# conectar — maioria dos provedores), "ssl" (porta 465, criptografado
+# desde o início), ou "none".
+SMTP_HOST = ""
+SMTP_PORT = 587
+SMTP_SEC  = "starttls"
+SMTP_USER = ""
+SMTP_PASS = ""
+SMTP_FROM = ""
+SMTP_TO   = ""
+# Pula a validação do certificado TLS. Necessário pra proxies SMTP
+# locais com certificado autoassinado — ex. Proton Mail Bridge
+# (127.0.0.1), Mailhog, Mailpit. Deixe false pra um provedor remoto real.
+SMTP_INSECURE = false
+
+# Checa no npm se tem versão nova do manybot: ao iniciar, e depois a cada
+# UPDATE_CHECK_INTERVAL_HOURS.
+UPDATE_CHECK_ENABLED       = true
+UPDATE_CHECK_INTERVAL_HOURS = 24
 
 # Como conectar pela primeira vez: "qr" (escaneie com o WhatsApp no celular)
 # ou "phone" (recebe um código de pareamento no número definido em
 # PHONE_NUMBER). Deixe em branco para escolher interativamente na primeira
 # execução — a escolha é salva aqui automaticamente.
 LOGIN_METHOD = ""
+
+# ── Página de status ────────────────────────────────────────────────────────
+# Página HTTP local mostrando se o bot está online ou offline.
+STATUS_ENABLED = true
+STATUS_PORT    = 8080
+
+# ── Seleção de driver (avançado) ───────────────────────────────────────────
+# ManyBot pode cair de um driver primário pra um secundário quando o
+# primário não confirma um envio. Hoje só Baileys está ligado; deixe
+# driver_whatsmeow_enabled = false pra desligar o fallback por completo
+# (nenhum processo extra é spawnado, nenhum socket é aberto).
+driver_primary = "baileys"
+driver_fallback_cooldown_ms = 60000
+driver_verify_window_ms = [500, 1000, 1500, 2500, 5000]
+driver_baileys_enabled = true
+driver_whatsmeow_enabled = false
+driver_whatsmeow_grpc_address = "localhost:50051"
+driver_whatsmeow_binary_path = ""
 `;
 const DEFAULT_TOML = detectSystemLang() === "pt" ? DEFAULT_TOML_PT : DEFAULT_TOML_EN;
 await fs.mkdir(CONFIG_DIR, { recursive: true });
@@ -262,11 +366,32 @@ const DEFAULTS = {
     CMD_PREFIX: "!",
     CLIENT_ID: "manybot",
     CHATS: [],
+    EXCLUDE_CHATS: [],
+    SECURITY_LEVEL: "medium",
     PLUGINS: [],
     LANGUAGE: "en",
     PHONE_NUMBER: null,
-    PLATFORM: "whatsapp",
     LOGIN_METHOD: null,
+    ADMIN_JID: "",
+    SMTP_HOST: "",
+    SMTP_PORT: 587,
+    SMTP_SEC: "starttls",
+    SMTP_USER: "",
+    SMTP_PASS: "",
+    SMTP_FROM: "",
+    SMTP_TO: "",
+    SMTP_INSECURE: false,
+    UPDATE_CHECK_ENABLED: true,
+    UPDATE_CHECK_INTERVAL_HOURS: 24,
+    STATUS_ENABLED: true,
+    STATUS_PORT: 8080,
+    drivers: {
+        primary: "baileys",
+        fallbackCooldownMs: 60000,
+        verifyWindowMs: [500, 1000, 1500, 2500, 5000],
+        baileys: { enabled: true },
+        whatsmeow: { enabled: false, grpcAddress: "localhost:50051", binaryPath: "" },
+    },
 };
 function normalize(cfg) {
     // Empty string and absent PHONE_NUMBER are both treated as null so plugins
@@ -279,6 +404,83 @@ function normalize(cfg) {
     if (cfg.LOGIN_METHOD !== "phone" && cfg.LOGIN_METHOD !== "qr") {
         cfg.LOGIN_METHOD = null;
     }
+    if (!["low", "medium", "high"].includes(cfg.SECURITY_LEVEL)) {
+        cfg.SECURITY_LEVEL = "medium";
+    }
+    // Legacy .conf values arrive as strings; TOML gives real types already —
+    // Number()/coercion here is a no-op for the TOML path.
+    cfg.SMTP_PORT = Number(cfg.SMTP_PORT) || 587;
+    if (!["starttls", "ssl", "none"].includes(cfg.SMTP_SEC)) {
+        cfg.SMTP_SEC = "starttls";
+    }
+    const rawUpdateEnabled = cfg.UPDATE_CHECK_ENABLED;
+    cfg.UPDATE_CHECK_ENABLED = rawUpdateEnabled !== false && rawUpdateEnabled !== "false";
+    const rawSmtpInsecure = cfg.SMTP_INSECURE;
+    cfg.SMTP_INSECURE = rawSmtpInsecure === true || rawSmtpInsecure === "true";
+    cfg.UPDATE_CHECK_INTERVAL_HOURS = Number(cfg.UPDATE_CHECK_INTERVAL_HOURS) || 24;
+    const rawStatusEnabled = cfg.STATUS_ENABLED;
+    cfg.STATUS_ENABLED = rawStatusEnabled !== false && rawStatusEnabled !== "false";
+    cfg.STATUS_PORT = Number(cfg.STATUS_PORT) || 8080;
+    // drivers.* — the fallback guard and DriverManager read these at every
+    // send. The TOML surface is flat lowercase keys (driver_primary,
+    // driver_baileys_enabled, driver_whatsmeow_*, …) so it matches the
+    // rest of the file; the nested `cfg.drivers` object is rebuilt here
+    // from those flat keys so callers (main.ts, sendFallbackGuard.ts,
+    // supervisor.ts, client.ts) keep using `CONFIG.drivers.*`.
+    // Coerce strings (legacy .conf arrives as strings) and reject anything
+    // that isn't a recognized driver name, so a typo in TOML falls back
+    // to the safe default rather than crashing at boot.
+    const isTruthy = (v) => v === true || v === "true";
+    const coerceEnabled = (v, fallback) => {
+        if (v === true || v === false)
+            return v;
+        if (v === "true")
+            return true;
+        if (v === "false")
+            return false;
+        return fallback;
+    };
+    // Allow either the new flat keys or (for backward compatibility) the
+    // old nested `[drivers]` block. Flat keys take precedence.
+    const nestedDrv = (cfg.drivers ?? {});
+    const flatPrimary = cfg.driver_primary ?? nestedDrv.primary;
+    const flatCooldown = cfg.driver_fallback_cooldown_ms ?? nestedDrv.fallbackCooldownMs;
+    const flatVerify = cfg.driver_verify_window_ms ?? nestedDrv.verifyWindowMs;
+    const flatBaileysEnabled = cfg.driver_baileys_enabled ?? nestedDrv.baileys?.enabled;
+    const flatWhatsmeowEnabled = cfg.driver_whatsmeow_enabled ?? nestedDrv.whatsmeow?.enabled;
+    const flatWhatsmeowGrpc = cfg.driver_whatsmeow_grpc_address ?? nestedDrv.whatsmeow?.grpcAddress;
+    const flatWhatsmeowBinary = cfg.driver_whatsmeow_binary_path ?? nestedDrv.whatsmeow?.binaryPath;
+    cfg.drivers = {
+        primary: flatPrimary === "whatsmeow" ? "whatsmeow" : "baileys",
+        fallbackCooldownMs: Number(flatCooldown) || 60000,
+        verifyWindowMs: Array.isArray(flatVerify) && flatVerify.length
+            ? flatVerify.map((n) => Number(n)).filter((n) => Number.isFinite(n) && n > 0)
+            : [500, 1000, 1500, 2500, 5000],
+        baileys: {
+            enabled: coerceEnabled(flatBaileysEnabled, true),
+        },
+        whatsmeow: {
+            // MANYBOT_SMOKE=1 force-enables whatsmeow regardless of the TOML
+            // value — used by scripts/smoke-whatsmeow-supervisor.mjs so the
+            // smoke test doesn't depend on the local manybot.toml already
+            // having driver_whatsmeow_enabled = true. Not a documented
+            // user-facing setting; TOML remains the source of truth outside
+            // smoke runs.
+            enabled: process.env.MANYBOT_SMOKE === "1" ? true : isTruthy(flatWhatsmeowEnabled),
+            grpcAddress: typeof flatWhatsmeowGrpc === "string" ? flatWhatsmeowGrpc : "localhost:50051",
+            binaryPath: typeof flatWhatsmeowBinary === "string" ? flatWhatsmeowBinary : "",
+        },
+    };
+    // Drop the flat keys from the merged object so they don't leak as
+    // loose top-level Config keys (the `Config` interface exposes only
+    // the nested `drivers` block).
+    delete cfg.driver_primary;
+    delete cfg.driver_fallback_cooldown_ms;
+    delete cfg.driver_verify_window_ms;
+    delete cfg.driver_baileys_enabled;
+    delete cfg.driver_whatsmeow_enabled;
+    delete cfg.driver_whatsmeow_grpc_address;
+    delete cfg.driver_whatsmeow_binary_path;
     return cfg;
 }
 export const CONFIG = normalize({
@@ -302,6 +504,8 @@ export async function reloadConfig() {
     PLUGINS.push(...(CONFIG.PLUGINS || []));
     CHATS.length = 0;
     CHATS.push(...(CONFIG.CHATS || []));
+    EXCLUDE_CHATS.length = 0;
+    EXCLUDE_CHATS.push(...(CONFIG.EXCLUDE_CHATS || []));
 }
 // ---------------------------------------------------------------------------
 // Named exports — identical shape regardless of config source
@@ -309,11 +513,25 @@ export async function reloadConfig() {
 export const CLIENT_ID = CONFIG.CLIENT_ID;
 export const CMD_PREFIX = CONFIG.CMD_PREFIX;
 export const CHATS = CONFIG.CHATS;
+export const EXCLUDE_CHATS = CONFIG.EXCLUDE_CHATS;
+export const SECURITY_LEVEL = CONFIG.SECURITY_LEVEL;
 export const PLUGINS = CONFIG.PLUGINS;
 export const LANGUAGE = CONFIG.LANGUAGE;
 export const PHONE_NUMBER = CONFIG.PHONE_NUMBER;
-export const PLATFORM = CONFIG.PLATFORM;
 export const LOGIN_METHOD = CONFIG.LOGIN_METHOD;
+export const ADMIN_JID = CONFIG.ADMIN_JID;
+export const SMTP_HOST = CONFIG.SMTP_HOST;
+export const SMTP_PORT = CONFIG.SMTP_PORT;
+export const SMTP_SEC = CONFIG.SMTP_SEC;
+export const SMTP_USER = CONFIG.SMTP_USER;
+export const SMTP_PASS = CONFIG.SMTP_PASS;
+export const SMTP_FROM = CONFIG.SMTP_FROM;
+export const SMTP_TO = CONFIG.SMTP_TO;
+export const SMTP_INSECURE = CONFIG.SMTP_INSECURE;
+export const UPDATE_CHECK_ENABLED = CONFIG.UPDATE_CHECK_ENABLED;
+export const UPDATE_CHECK_INTERVAL_HOURS = CONFIG.UPDATE_CHECK_INTERVAL_HOURS;
+export const STATUS_ENABLED = CONFIG.STATUS_ENABLED;
+export const STATUS_PORT = CONFIG.STATUS_PORT;
 /**
  * Writes a single value back to manybot.toml without rewriting the whole
  * file (preserves comments and the rest of the content). If the key