aunubaileys 1.0.47 → 1.0.48

package/README.md

@@ -64,6 +64,10 @@ Everything else is pure upstream. When upstream moves, we rebase the patch layer
 
 
 
+### 🆕 What's new in 1.0.48 / Baru di 1.0.48
+
+- 🩹 **Group Bad MAC now heals both layers.** The "Bad MAC" error (from Tenka's live log on 11 Nov 2026, the same LID address as the B-01 finding and the 1.0.46 flood) is thrown by `SessionCipher` — the whisper/E2E session layer — and in groups it can equally come from the sender-key layer. The old strike-limit path (1.0.14) for groups deleted only the sender key, so a rotten E2E session of the author was never touched and the failures repeated forever: the same wrong-layer class that 1.0.46 closed for session failures, now closed on the strike path. At the 3-failure limit, groups now reset the author's E2E session (including the alternate PN↔LID address record) AND drop the sender key, with the retry receipt carrying fresh keys. DM behaviour and the 3-strike threshold are unchanged. The `messages.decrypt-failure` event now distinguishes `errorClass: 'bad-mac'` from `'session'`/`'other'` (new exported predicate: `isBadMacError(text)`).
+
 ### 🧪 What's new in 1.0.47 / Baru di 1.0.47 — EXPERIMENTAL
 
 - 🧪 **Five experimental features that exist only in AunuBaileys**, in a single version. All are attached automatically to the socket returned by `makeWASocket` and are explicitly experimental — semantics may change in any release: (1) **Invisible text watermark** — `sock.aunuWatermark(text, tag)` hides a short tag (bot name, campaign, build) inside message text as zero-width characters for leak tracing and fingerprinting; the visible text is unchanged; companions `aunuReadWatermark(text)` and `aunuStripWatermark(text)`, plus root utils `encodeWatermark`/`appendWatermark`/`extractWatermark`/`stripWatermark`. (2) **Human send** — `sock.aunuHumanSend(jid, content)`: shows "composing" for a plausible typing duration derived from the text length (util `computeTypingDuration`, clamped 700–8000 ms, ±20% jitter), then sends. (3) **Scheduled send** — `sock.aunuSchedule(jid, content, when)` (ms delay or Date) with `aunuCancelScheduled(id)` and `aunuListScheduled()`; in-memory, lost on restart. (4) **Self-destruct** — `sock.aunuSelfDestruct(jid, content, seconds)`: sends, then revokes the message for everyone after N seconds; `aunuCancelSelfDestruct(messageId)` cancels. (5) **Connection doctor** — `sock.aunuDoctor()`: one structured health snapshot (bundled WA version, registration state, open transport, known LID pair count, pending experimental timers).

package/lib/Socket/messages-recv.js

@@ -5,7 +5,7 @@ import Long from 'long';
 import { proto } from '../../WAProto/index.js';
 import { DEFAULT_CACHE_TTLS, KEY_BUNDLE_TYPE, MIN_PREKEY_COUNT } from '../Defaults/index.js';
 import { WAMessageStatus, WAMessageStubType } from '../Types/index.js';
-import { aesDecryptCTR, aesEncryptGCM, cleanMessage, Curve, decodeMediaRetryNode, decodeMessageNode, decryptMessageNode, delay, derivePairingCodeKey, encodeBigEndian, encodeSignedDeviceIdentity, getCallStatusFromNode, getHistoryMsg, getNextPreKeys, getStatusFromReceiptType, hkdf, isUnrecoverableSessionError, MISSING_KEYS_ERROR_TEXT, NACK_REASONS, NO_MESSAGE_FOUND_ERROR_TEXT, buildCallControlStanza, parseRetryReceiptSession, unixTimestampSeconds, xmppPreKey, xmppSignedPreKey } from '../Utils/index.js';
+import { aesDecryptCTR, aesEncryptGCM, cleanMessage, Curve, decodeMediaRetryNode, decodeMessageNode, decryptMessageNode, delay, derivePairingCodeKey, encodeBigEndian, encodeSignedDeviceIdentity, getCallStatusFromNode, getHistoryMsg, getNextPreKeys, getStatusFromReceiptType, hkdf, isBadMacError, isUnrecoverableSessionError, MISSING_KEYS_ERROR_TEXT, NACK_REASONS, NO_MESSAGE_FOUND_ERROR_TEXT, buildCallControlStanza, parseRetryReceiptSession, unixTimestampSeconds, xmppPreKey, xmppSignedPreKey } from '../Utils/index.js';
 import { makeMutex } from '../Utils/make-mutex.js';
 import { sentMessageCacheFor } from '../Utils/sent-message-cache.js';
 import { areJidsSameUser, getAllBinaryNodeChildren, getBinaryNodeChild, getBinaryNodeChildBuffer, getBinaryNodeChildren, getBinaryNodeChildString, isJidGroup, isJidStatusBroadcast, isJidUser, isLidUser, jidDecode, jidNormalizedUser, S_WHATSAPP_NET } from '../WABinary/index.js';
@@ -789,8 +789,15 @@ export const makeMessagesRecvSocket = (config) => {
                                         }
                                         else if (fails >= DECRYPT_FAIL_SESSION_RESET_LIMIT) {
                                             if (isGroupMsg) {
+                                                // AunuBaileys (1.0.48): Bad MAC adalah error
+                                                // lapis whisper/sesi E2E (SessionCipher), dan
+                                                // di grup ia juga bisa datang dari lapis
+                                                // sender key — menghapus sender key SAJA
+                                                // (perilaku 1.0.14) tidak menyentuh sesi E2E
+                                                // penulis yang busuk. Bersihkan keduanya.
+                                                await resetE2ESession();
                                                 await signalRepository.deleteSenderKey(msg.key.remoteJid, author);
-                                                logger.warn({ author, group: msg.key.remoteJid }, 'aunu: deleted stale sender-key record after repeated group decrypt failures; retry request asks the author to resend with a fresh distribution message');
+                                                logger.warn({ author, group: msg.key.remoteJid }, 'aunu: reset E2E session and deleted stale sender-key record after repeated group decrypt failures; retry receipt carries fresh keys');
                                             }
                                             else {
                                                 await resetE2ESession();
@@ -813,7 +820,7 @@ export const makeMessagesRecvSocket = (config) => {
                                             isGroup: isGroupMsg,
                                             failures: fails,
                                             healed,
-                                            errorClass: sessionLayerFailure ? 'session' : 'other',
+                                            errorClass: sessionLayerFailure ? 'session' : (isBadMacError(msg?.messageStubParameters?.[0]) ? 'bad-mac' : 'other'),
                                             messageId: node.attrs.id,
                                             timestamp: Date.now()
                                         });

package/lib/Utils/decode-wa-message.d.ts

@@ -3,6 +3,7 @@ import { type BinaryNode } from '../WABinary/index.js';
 import type { ILogger } from './logger.js';
 export declare const NO_MESSAGE_FOUND_ERROR_TEXT = "Message absent from node";
 export declare const isUnrecoverableSessionError: (text: unknown) => boolean;
+export declare const isBadMacError: (text: unknown) => boolean;
 export declare const MISSING_KEYS_ERROR_TEXT = "Key used already or never filled";
 export declare const NACK_REASONS: {
     ParsingError: number;

package/lib/Utils/decode-wa-message.js

@@ -227,4 +227,11 @@ export const decryptMessageNode = (stanza, meId, meLid, repository, logger) => {
  */
 export const isUnrecoverableSessionError = (text) => typeof text === 'string' &&
     /no matching sessions found|no session record|no sessions available/i.test(text);
+/**
+ * AunuBaileys: true when a decrypt failure text is a MAC verification
+ * failure ("Bad MAC") — the stored session/sender-key state and the
+ * sender's state disagree about the message authentication code, the
+ * classic symptom of a desynchronised ratchet on either side.
+ */
+export const isBadMacError = (text) => typeof text === 'string' && /bad mac/i.test(text);
 //# sourceMappingURL=decode-wa-message.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aunubaileys",
   "type": "module",
-  "version": "1.0.47",
+  "version": "1.0.48",
   "description": "AunuBaileys \u2014 a WhatsApp Web API for bots that never sleep. Full upstream power with the beloved in-memory store restored and pairing that just works. Forged by AunuCore.",
   "keywords": [
     "whatsapp",