@xbibzlibrary/whatsbibz 1.3.0 → 1.3.2

package/SECURITY.md

@@ -0,0 +1,91 @@
+# Security Policy
+
+*Bahasa Indonesia di bawah / Indonesian version below.*
+
+## Supported versions
+
+| Version | Supported |
+|---|---|
+| 1.3.x | Yes |
+| < 1.3 | No — please upgrade |
+
+Only the latest minor release receives security fixes.
+
+## Reporting a vulnerability
+
+**Please do not open a public issue for security problems.**
+
+Report privately by one of these channels:
+
+- GitHub: **Security → Report a vulnerability** on this repository (private advisory).
+- Email: **revandoppratama@gmail.com** with the subject `[whatsbibz security]`.
+
+Include:
+
+- A description of the issue and its impact.
+- Steps or a script to reproduce it.
+- The package version (`npm ls @xbibzlibrary/whatsbibz`) and Node.js version.
+- Whether the issue requires a paired session, network position, or a malicious remote peer.
+
+You will get an acknowledgement within **3 business days** and a status update at least every **7 days** until the issue is resolved. When a fix is released you will be credited in the changelog unless you prefer otherwise.
+
+## What counts as a vulnerability here
+
+- Anything that lets a **remote WhatsApp peer** (a contact, a group member, a newsletter) execute code, crash the process, corrupt local state or read data it should not — for example through a crafted `protocolMessage`, media metadata or app-state patch.
+- Leakage of session material (`creds.json`, signal keys, `identity.json`) through logs, error messages or file permissions.
+- Weaknesses in the pairing or Noise handshake handling that were introduced by this fork.
+- Dependency vulnerabilities that are reachable from this package's code paths.
+
+Out of scope: WhatsApp server behaviour, account bans, rate limits, and issues in the upstream Baileys project that are not reachable through WhatsBibz (please report those upstream).
+
+## Handling secrets safely
+
+- Session folders contain long-lived credentials. Keep them outside the repository, with restrictive permissions, and never share them.
+- Rotate your credentials (`client.logout()` and re-pair) if a session folder may have leaked.
+- Do not paste `creds.json`, pairing codes for real numbers, or tokens into issues.
+
+---
+
+# Kebijakan Keamanan
+
+## Versi yang didukung
+
+| Versi | Didukung |
+|---|---|
+| 1.3.x | Ya |
+| < 1.3 | Tidak — silakan perbarui |
+
+Hanya rilis minor terbaru yang menerima perbaikan keamanan.
+
+## Melaporkan kerentanan
+
+**Jangan membuka issue publik untuk masalah keamanan.**
+
+Laporkan secara pribadi lewat salah satu jalur berikut:
+
+- GitHub: **Security → Report a vulnerability** di repositori ini (advisory privat).
+- Email: **revandoppratama@gmail.com** dengan subjek `[whatsbibz security]`.
+
+Sertakan:
+
+- Deskripsi masalah dan dampaknya.
+- Langkah atau skrip untuk mereproduksinya.
+- Versi paket (`npm ls @xbibzlibrary/whatsbibz`) dan versi Node.js.
+- Apakah masalah memerlukan sesi yang sudah tertaut, posisi jaringan tertentu, atau lawan bicara jarak jauh yang berniat jahat.
+
+Kamu akan menerima konfirmasi dalam **3 hari kerja** dan pembaruan status setidaknya setiap **7 hari** sampai masalah selesai. Saat perbaikan dirilis, namamu dicantumkan di changelog kecuali kamu meminta sebaliknya.
+
+## Yang dianggap kerentanan di sini
+
+- Apa pun yang memungkinkan **peer WhatsApp jarak jauh** (kontak, anggota grup, newsletter) mengeksekusi kode, membuat proses crash, merusak state lokal, atau membaca data yang seharusnya tidak bisa — misalnya lewat `protocolMessage`, metadata media, atau patch app-state yang direkayasa.
+- Kebocoran materi sesi (`creds.json`, kunci signal, `identity.json`) lewat log, pesan error, atau izin berkas.
+- Kelemahan dalam penanganan pairing atau handshake Noise yang diperkenalkan oleh fork ini.
+- Kerentanan dependensi yang dapat dijangkau dari jalur kode paket ini.
+
+Di luar cakupan: perilaku server WhatsApp, pemblokiran akun, batas laju, dan masalah di proyek upstream Baileys yang tidak dapat dijangkau lewat WhatsBibz (silakan laporkan ke upstream).
+
+## Menjaga rahasia dengan aman
+
+- Folder sesi berisi kredensial berumur panjang. Simpan di luar repositori, dengan izin terbatas, dan jangan pernah dibagikan.
+- Rotasi kredensialmu (`client.logout()` lalu pairing ulang) bila folder sesi mungkin bocor.
+- Jangan menempelkan `creds.json`, pairing code untuk nomor sungguhan, atau token ke dalam issue.

package/lib/BibzWhats/client.js

@@ -302,7 +302,15 @@ export async function createBibzWhats(options = {}) {
         stopPairingRef = stopPairing;
 
         sock.ev.on('creds.update', (update) => {
-            void saveCreds(update);
+            // Folder sesi bisa sudah hilang (dihapus pemakai / wipe / close di tengah tulis):
+            // jangan biarkan jadi unhandled rejection yang mematikan proses.
+            saveCreds(update).catch((e) => {
+                if (closedByUser || e?.code === 'ENOENT') {
+                    if (!closedByUser) log.warn(`BibzWhats: gagal menyimpan kredensial (${e.code}) — folder sesi ${opts.authDir} hilang; akan dibuat ulang saat sambung berikutnya.`);
+                    return;
+                }
+                log.error(`BibzWhats: gagal menyimpan kredensial: ${e?.message || e}`);
+            });
             if (sock.authState.creds.registered) stopPairing();
         });
 
@@ -316,12 +324,12 @@ export async function createBibzWhats(options = {}) {
                 if (opts.phone && !pairingStarted) {
                     pairingStarted = true;
                     log.info('BibzWhats: perangkat belum terdaftar — meminta pairing code...');
-                    void pairing.start();
+                    pairing.start().catch((e) => log.error(`BibzWhats: pairing gagal: ${e?.message || e}`));
                 }
                 const showQr = !opts.phone || Date.now() - pairingStartedAt > opts.qrFallbackAfterMs;
                 if (showQr) {
                     emitter.emit('qr', qr);
-                    if (opts.printQR) void printQrToTerminal(qr, log);
+                    if (opts.printQR) Promise.resolve(printQrToTerminal(qr, log)).catch(() => {});
                 }
             }
             if (sock.authState.creds.registered) stopPairing();
@@ -331,7 +339,7 @@ export async function createBibzWhats(options = {}) {
                     if (!sock.authState.creds.registered && !pairingStarted) {
                         pairingStarted = true;
                         log.info('BibzWhats: QR tidak diterima — minta pairing code langsung...');
-                        void pairing.start();
+                        pairing.start().catch((e) => log.error(`BibzWhats: pairing gagal: ${e?.message || e}`));
                     }
                 }, opts.pairingRequestDelayMs);
             }

package/lib/BibzWhats/version.js

@@ -1,7 +1,7 @@
 export const BIBZWHATS_NAME = 'WhatsBibz';
 /** nama paket di npm */
 export const BIBZWHATS_PACKAGE = '@xbibzlibrary/whatsbibz';
-export const BIBZWHATS_VERSION = '1.3.0';
+export const BIBZWHATS_VERSION = '1.3.2';
 export const BIBZWHATS_UPSTREAM = 'ourin-baileys@9.0.21 (fork WhiskeySockets/Baileys v7) + patch upstream s/d rc14/master 2026-08 & PR #2769/#2776/#2778/#2789; identitas platform diukur ke server 2026-09-03';
 /** versi WA Web bawaan (fallback) — diperbarui 2026-09-03 dari web.whatsapp.com */
-export const BIBZWHATS_WA_WEB_VERSION = [2, 3000, 1046721733];
+export const BIBZWHATS_WA_WEB_VERSION = [2, 3000, 1046874154];

package/lib/Defaults/index.js

@@ -2,7 +2,7 @@ import { proto } from "../../WAProto/index.js";
 import { makeLibSignalRepository } from "../Signal/libsignal.js";
 import { Browsers } from "../Utils/browser-utils.js";
 import logger from "../Utils/logger.js";
-const version = [2, 3000, 1046721733];
+const version = [2, 3000, 1046874154];
 export const UNAUTHORIZED_CODES = [401, 403, 419];
 export const DEFAULT_ORIGIN = "https://web.whatsapp.com";
 export const CALL_VIDEO_PREFIX = "https://call.whatsapp.com/video/";

package/lib/Utils/browser-utils.js

@@ -28,9 +28,9 @@ export const Browsers = {
     linux: browser => ['Linux', browser, '6.12.44'],
     baileys: browser => ['Baileys', browser, '6.5.0'],
     /** identitas companion BibzWhats (tampil di daftar perangkat tertaut) */
-    whatsbibz: browser => ['WhatsBibz', browser, '1.3.0'],
+    whatsbibz: browser => ['WhatsBibz', browser, '1.3.2'],
     /** alias lama */
-    bibzwhats: browser => ['WhatsBibz', browser, '1.3.0'],
+    bibzwhats: browser => ['WhatsBibz', browser, '1.3.2'],
     windows: browser => ['Windows', browser, '10.0.22631'],
     /** eksperimental (upstream #2201): companion Android — bisa menerima view-once */
     android: browser => [browser, 'Android', ''],

package/lib/Utils/generics.js

@@ -1,7 +1,7 @@
 import { Boom } from '@hapi/boom';
 import { createHash, randomBytes } from 'crypto';
 import { proto } from '../../WAProto/index.js';
-const bibzWhatsVersion = [2, 3000, 1046721733];
+const bibzWhatsVersion = [2, 3000, 1046874154];
 import { DisconnectReason } from '../Types/index.js';
 import { getAllBinaryNodeChildren, jidDecode } from '../WABinary/index.js';
 import { sha256 } from './crypto.js';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@xbibzlibrary/whatsbibz",
-  "version": "1.3.0",
-  "description": "WhatsBibz — library WhatsApp Web multi-device (fork Baileys v7 / ourin-baileys) untuk ekosistem Xbibz: pairing code custom, identitas perangkat kustom/otomatis, auto-reconnect, self-healing session, handler companion_reg_refresh bawaan, interactive message, album, newsletter, VoIP.",
+  "version": "1.3.2",
+  "description": "WhatsBibz — WhatsApp Web multi-device library for Node.js (maintained Baileys fork): high-level client, custom pairing codes, self-healing sessions, configurable or automatic linked-device identity, complete TypeScript declarations.",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -20,6 +20,7 @@
     "LICENSE",
     "LICENSE.upstream",
     "README.md",
+    "README.id.md",
     "CHANGELOG.md",
     "assets/logo/preview.png",
     "assets/logo/whatsbibz.ico",
@@ -27,7 +28,8 @@
     "assets/logo/png/mark-512.png",
     "assets/logo/png/banner-1200x360.png",
     "assets/logo/README.md",
-    "VERIFIKASI-IDENTITAS-2026-09-03.md"
+    "VERIFIKASI-IDENTITAS-2026-09-03.md",
+    "SECURITY.md"
   ],
   "scripts": {
     "test": "node --test test/*.test.js",
@@ -50,9 +52,21 @@
     "bot",
     "automation"
   ],
-  "author": "Xbibz Developer",
+  "author": {
+    "name": "Xbibz Developer",
+    "email": "revandoppratama@gmail.com",
+    "url": "https://github.com/XbibzOfficial777"
+  },
   "license": "MIT",
-  "homepage": "https://www.npmjs.com/package/@xbibzlibrary/whatsbibz",
+  "homepage": "https://github.com/XbibzOfficial777/whatsbibz#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/XbibzOfficial777/whatsbibz.git"
+  },
+  "bugs": {
+    "url": "https://github.com/XbibzOfficial777/whatsbibz/issues",
+    "email": "revandoppratama@gmail.com"
+  },
   "engines": {
     "node": ">=20.0.0"
   },
@@ -105,7 +119,7 @@
     }
   },
   "devDependencies": {
-    "typescript": "^5.9.2",
+    "typescript": "^7.0.2",
     "@types/node": "^22.18.0"
   }
 }