aunubaileys 1.0.16 → 1.0.17

package/README.md

@@ -64,6 +64,10 @@ Everything else is pure upstream. When upstream moves, we rebase the patch layer
 
 
 
+### 🆕 What's new in 1.0.17 / Baru di 1.0.17
+
+- 👥 **Group sender-key heal** — the 1.0.14 failure counter now covers group messages too: after 3 consecutive group decrypt failures from the same author in the same group, the stale sender-key record is deleted (new `signalRepository.deleteSenderKey`), so the next retry makes the author resend with a fresh distribution message and the group cipher rebuilds from scratch. One rotten sender-key record can no longer mute a group member forever.
+
 ### 🆕 What's new in 1.0.16 / Baru di 1.0.16
 
 - 🪪 **Identity changes are handled, not just logged** — when WhatsApp notifies that a contact's identity changed (new phone / reinstall / recycled number), upstream Baileys logs “identity changed” and does nothing, leaving your stored session bound to the old identity so that contact's messages keep failing. AunuBaileys now deletes the stored session for that JID on the spot, so the next exchange re-initiates cleanly against the new identity.

package/lib/Signal/libsignal.js

@@ -66,6 +66,10 @@ export function makeLibSignalRepository(auth) {
                 senderKeyDistributionMessage: senderKeyDistributionMessage.serialize()
             };
         },
+        async deleteSenderKey(group, authorJid) {
+            const senderNameStr = jidToSignalSenderKeyName(group, authorJid).toString();
+            await auth.keys.set({ 'sender-key': { [senderNameStr]: null } });
+        },
         async deleteSession(jid) {
             const addr = jidToSignalProtocolAddress(jid).toString();
             await auth.keys.set({ session: { [addr]: null } });

package/lib/Socket/messages-recv.js

@@ -677,18 +677,26 @@ export const makeMessagesRecvSocket = (config) => {
                                 }
                                 const encNode = getBinaryNodeChild(node, 'enc');
                                 let forceIncludeKeys = !encNode;
-                                if (!isJidGroup(msg.key.remoteJid) && author) {
+                                if (author) {
                                     try {
+                                        const isGroupMsg = isJidGroup(msg.key.remoteJid);
                                         const addr = signalRepository.jidToSignalProtocolAddress(author);
-                                        const fails = (decryptFailCounts.get(addr) || 0) + 1;
+                                        const failKey = isGroupMsg ? `sk:${msg.key.remoteJid}:${addr}` : addr;
+                                        const fails = (decryptFailCounts.get(failKey) || 0) + 1;
                                         if (fails >= DECRYPT_FAIL_SESSION_RESET_LIMIT) {
-                                            await signalRepository.deleteSession(author);
-                                            decryptFailCounts.delete(addr);
+                                            if (isGroupMsg) {
+                                                await signalRepository.deleteSenderKey(msg.key.remoteJid, author);
+                                                logger.warn({ author, group: msg.key.remoteJid }, 'aunu: deleted stale sender-key record after repeated group decrypt failures; retry request asks the author to resend with a fresh distribution message');
+                                            }
+                                            else {
+                                                await signalRepository.deleteSession(author);
+                                                logger.warn({ author, addr }, 'aunu: deleted stale E2E session after repeated decrypt failures (Bad MAC self-heal); retry receipt carries fresh keys');
+                                            }
+                                            decryptFailCounts.delete(failKey);
                                             forceIncludeKeys = true;
-                                            logger.warn({ author, addr }, 'aunu: deleted stale E2E session after repeated decrypt failures (Bad MAC self-heal); retry receipt carries fresh keys');
                                         }
                                         else {
-                                            decryptFailCounts.set(addr, fails);
+                                            decryptFailCounts.set(failKey, fails);
                                         }
                                     }
                                     catch (healErr) {
@@ -708,7 +716,9 @@ export const makeMessagesRecvSocket = (config) => {
                     else {
                         if (author) {
                             try {
-                                decryptFailCounts.delete(signalRepository.jidToSignalProtocolAddress(author));
+                                const addr = signalRepository.jidToSignalProtocolAddress(author);
+                                decryptFailCounts.delete(addr);
+                                decryptFailCounts.delete(`sk:${msg.key.remoteJid}:${addr}`);
                             }
                             catch { }
                         }

package/lib/Types/Signal.d.ts

@@ -54,6 +54,8 @@ export type SignalRepository = {
     injectE2ESession(opts: E2ESessionOpts): Promise<void>;
     /** AunuBaileys: delete the stored E2E session for a JID (used by the Bad MAC self-heal). */
     deleteSession(jid: string): Promise<void>;
+    /** AunuBaileys: delete the stored sender-key record for a group author (stale group session heal). */
+    deleteSenderKey(group: string, authorJid: string): Promise<void>;
     jidToSignalProtocolAddress(jid: string): string;
 };
 export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aunubaileys",
   "type": "module",
-  "version": "1.0.16",
+  "version": "1.0.17",
   "description": "AunuBaileys \u2014 a WhatsApp Web API for bots that never sleep. Full upstream power with the beloved in-memory store restored and pairing that just works. Forged by AunuCore.",
   "keywords": [
     "whatsapp",