baileys-antiban 3.8.0 → 3.8.2

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.8.1] - 2026-04-28
+
+### Fixed
+- **`getStealthSocketConfig({ os })` now propagates `os` properly.** v3.8.0 silently dropped the value (placeholder no-op spread). The `os` opt rewrites the first slot of the resulting browser tuple as documented.
+- **Browser fingerprint randomized.** v3.8.0 hardcoded `['Ubuntu', 'Chrome', '20.0.04']` for every consumer — identical fingerprint across the install base is trivially cluster-able by WhatsApp. Now picks at random from `STEALTH_BROWSER_POOL`, a frozen array of realistic Mac/Windows/Linux Chrome/Safari/Firefox/Edge tuples with real-world version strings. Pool is exported so callers can extend or override.
+- **`rampPresenceAfterConnect()` accepts `AbortSignal`.** v3.8.0 had no way to cancel the pending timer; if the socket disconnected during the ramp window the post-delay `sendPresenceUpdate` would run against a dead socket. New `signal` option causes the returned promise to reject with `AbortError` when aborted, and clears the timer.
+- **Structural types instead of `any`.** `sock` parameter now typed as `PresenceCapableSocket` (matches `presenceChoreographer.ts`). `getStealthSocketConfig()` returns a typed `StealthSocketConfig`. Consumers get autocomplete on `markOnlineOnConnect` / `browser`.
+- JSDoc claims corrected — removed phantom `os` default value.
+
+### Added
+- `STEALTH_BROWSER_POOL` (named export) — frozen pool of realistic browser tuples used by `getStealthSocketConfig()`.
+- `AbortError` (named export) — thrown when `rampPresenceAfterConnect` is aborted via signal. Mirrors DOM `AbortError` semantics.
+- New typed exports: `BrowserTuple`, `StealthSocketConfig`, `GetStealthSocketConfigOptions`, `RampPresenceOptions`, `PresenceCapableSocket`.
+- `random` opt on both helpers — inject custom RNG (useful for deterministic tests).
+- `browser` opt on `getStealthSocketConfig()` — supply an explicit tuple. Takes precedence over `os` and the pool.
+
+### Migration
+- v3.8.0 → v3.8.1 is non-breaking. The shape of the returned config is unchanged at runtime; the default browser tuple is now random rather than fixed. If you depended on the exact `['Ubuntu', 'Chrome', '20.0.04']` value, pass it explicitly via `browser: ['Ubuntu', 'Chrome', '20.0.04']`.
+
 ## [3.8.0] - 2026-04-28
 
 ### Added

package/README.md

@@ -599,19 +599,42 @@ npx baileys-antiban warmup --simulate 7 --preset moderate
 npx baileys-antiban reset --state ./antiban-state.json
 ```
 
-### Stealth Connect (v3.8.0)
+### Stealth Connect (v3.8.1)
 
-Bots that instantly snap online and start blasting messages look suspicious. Stealth connect delays presence ramp to look more human.
+Bots that instantly snap online and start blasting messages look suspicious. Stealth connect joins WhatsApp without broadcasting `available`, then delays the presence ramp so the socket looks more like a human session.
 
 ```typescript
 import { makeWASocket } from '@whiskeysockets/baileys';
-import { getStealthSocketConfig, rampPresenceAfterConnect } from 'baileys-antiban';
+import {
+  getStealthSocketConfig,
+  rampPresenceAfterConnect,
+  AbortError,
+} from 'baileys-antiban';
 
+// Random fingerprint from STEALTH_BROWSER_POOL + markOnlineOnConnect: false.
+// Pass `os` to rebrand the OS slot, or `browser: [...]` to supply an explicit tuple.
 const config = getStealthSocketConfig({ os: 'My Custom App' });
 const sock = makeWASocket({ ...config, auth: state });
 
-// Wait 30-90s, then go available (or fire-and-forget)
-await rampPresenceAfterConnect(sock, { minDelayMs: 45000, maxDelayMs: 120000 });
+// Cancel the pending ramp if the socket dies before the timer fires.
+const ac = new AbortController();
+sock.ev.on('connection.update', (u) => {
+  if (u.connection === 'close') ac.abort();
+});
+
+try {
+  await rampPresenceAfterConnect(sock, {
+    minDelayMs: 45000,
+    maxDelayMs: 120000,
+    signal: ac.signal,
+  });
+} catch (err) {
+  if (err instanceof AbortError) {
+    // socket disconnected before ramp fired — swallow
+  } else {
+    throw err;
+  }
+}
 ```
 
 ## Quick Start (Legacy)

package/dist/index.d.ts

@@ -37,4 +37,4 @@ export { credsSnapshot, type CredsSnapshot, type CredsSnapshotConfig, } from './
 export { readReceiptVariance, type ReadReceiptVariance, type ReadReceiptVarianceConfig, } from './readReceiptVariance.js';
 export { proxyRotator, type ProxyEndpoint, type ProxyRotatorConfig, type ProxyRotatorStats, type ProxyRotatorHandle, } from './proxyRotator.js';
 export { generateSessionFingerprint, applySessionFingerprint, getMessageSendJitter, getTypingJitter, getRetryJitter, getVoiceNoteMetadata, getBatteryState, createStealthFingerprint, type SessionFingerprint, type SessionFingerprintConfig, } from './sessionFingerprint.js';
-export { getStealthSocketConfig, rampPresenceAfterConnect, } from './stealthConnect.js';
+export { getStealthSocketConfig, rampPresenceAfterConnect, STEALTH_BROWSER_POOL, AbortError, type BrowserTuple, type StealthSocketConfig, type GetStealthSocketConfigOptions, type RampPresenceOptions, type PresenceCapableSocket, } from './stealthConnect.js';

package/dist/index.js

@@ -52,4 +52,4 @@ export { proxyRotator, } from './proxyRotator.js';
 // v3.6 new modules (Obscura-inspired)
 export { generateSessionFingerprint, applySessionFingerprint, getMessageSendJitter, getTypingJitter, getRetryJitter, getVoiceNoteMetadata, getBatteryState, createStealthFingerprint, } from './sessionFingerprint.js';
 // v3.8 new modules
-export { getStealthSocketConfig, rampPresenceAfterConnect, } from './stealthConnect.js';
+export { getStealthSocketConfig, rampPresenceAfterConnect, STEALTH_BROWSER_POOL, AbortError, } from './stealthConnect.js';

package/dist/messageRecovery.js

@@ -152,12 +152,20 @@ export function messageRecovery(sock, config) {
         }
         for (const [jid, lastSeenEntry] of chatsToRecover) {
             try {
-                // Fetch messages newer than lastSeen timestamp
-                // fetchMessageHistory typically: (jid, count, cursor) => Promise<messages[]>
-                // We'll fetch up to 50 messages and filter by timestamp
-                const messages = await sock.fetchMessageHistory(jid, 50, {
-                    before: undefined, // Get latest
-                });
+                // Fetch messages newer than lastSeen timestamp.
+                // Baileys v7 may have changed this signature — fall back gracefully on any error.
+                let messages;
+                try {
+                    const result = await sock.fetchMessageHistory(jid, 50, { before: undefined });
+                    messages = Array.isArray(result) ? result : [];
+                }
+                catch {
+                    if (!loggedFetchWarning) {
+                        logger.warn?.(`[messageRecovery] sock.fetchMessageHistory failed — signature may have changed in this Baileys version. Recovery skipped for this reconnect.`);
+                        loggedFetchWarning = true;
+                    }
+                    continue;
+                }
                 if (!messages || !Array.isArray(messages))
                     continue;
                 // Filter to messages newer than lastSeen

package/dist/retryTracker.d.ts

@@ -54,6 +54,7 @@ export declare class RetryReasonTracker {
             id?: string;
         };
         status?: number;
+        update?: any;
         error?: any;
     }): void;
     /**

package/dist/retryTracker.js

@@ -61,10 +61,11 @@ export class RetryReasonTracker {
         const msgId = update.key?.id;
         if (!msgId)
             return;
-        // Only track error statuses
+        // Only track error statuses (status 0 = error in Baileys WAMessageStatus)
         if (update.status !== 0 && !update.error)
             return;
-        const reason = this.classify(update.error || update);
+        // rc10 may surface error info in update.update (wrapped message); check all forms
+        const reason = this.classify(update.error || update.update || update);
         this.recordRetry(msgId, reason);
     }
     /**

package/dist/stealthConnect.d.ts

@@ -1,39 +1,133 @@
 /**
- * Stealth Connect — Gradual presence ramp to reduce ban signals
+ * Stealth Connect — Reduce ban signal on socket connect + presence ramp
  *
  * Inspired by GOWA's --presence-on-connect=unavailable flag. Bots that
- * instantly snap online and start blasting messages look suspicious.
- * This helper connects without advertising "online" presence, then
- * gradually ramps to "available" after a randomized delay.
+ * snap online immediately and start blasting messages look suspicious to
+ * WhatsApp's anti-spam classifier. This module ships two helpers:
+ *
+ *   - `getStealthSocketConfig()` returns a partial Baileys socket config
+ *     that disables `markOnlineOnConnect` and provides a non-default
+ *     browser fingerprint (random pick from a small pool unless overridden).
+ *
+ *   - `rampPresenceAfterConnect()` waits a randomized delay, then issues
+ *     `sendPresenceUpdate('available')`. Supports `AbortSignal` so the
+ *     caller can cancel if the socket dies before the timer fires.
  *
  * Usage:
- *   const config = getStealthSocketConfig({ os: 'My Custom App' });
- *   const sock = makeWASocket({ ...config, ...otherOptions });
- *   await rampPresenceAfterConnect(sock, { minDelayMs: 45000, maxDelayMs: 120000 });
+ *   const config = getStealthSocketConfig({ os: 'MyApp' });
+ *   const sock = makeWASocket({ ...config, auth: state });
+ *
+ *   const ac = new AbortController();
+ *   sock.ev.on('connection.update', u => {
+ *     if (u.connection === 'close') ac.abort();
+ *   });
+ *   await rampPresenceAfterConnect(sock, { signal: ac.signal });
+ */
+/**
+ * Browser tuple expected by Baileys: [appName, browserName, browserVersion].
+ */
+export type BrowserTuple = [string, string, string];
+/**
+ * Pool of realistic browser fingerprints.
+ *
+ * Values match formats actually emitted by WhatsApp Web clients in the wild.
+ * `getStealthSocketConfig()` picks one at random when caller does not supply
+ * an explicit `browser` or `os` option, so multiple consumers of the library
+ * do not all advertise an identical fingerprint (which would be trivially
+ * cluster-able by WhatsApp).
+ *
+ * Exported so callers can extend or override the pool if desired.
  */
+export declare const STEALTH_BROWSER_POOL: readonly BrowserTuple[];
 /**
- * Returns socket configuration for stealth connect.
- * Sets markOnlineOnConnect=false and provides sensible browser defaults.
+ * Minimum structural shape a stealth socket config consumer needs.
+ * Avoids a hard dependency on Baileys' internal type names while still
+ * giving consumers TypeScript autocomplete on the keys we actually set.
+ */
+export interface StealthSocketConfig {
+    /** Whether Baileys broadcasts `available` presence on initial connect. */
+    markOnlineOnConnect: boolean;
+    /** Browser tuple sent during the WhatsApp Web pairing handshake. */
+    browser: BrowserTuple;
+}
+/**
+ * Options for `getStealthSocketConfig()`.
  *
- * @param opts.os - Optional custom OS name for device fingerprint (default: 'Baileys')
- * @returns Partial socket config to merge into makeWASocket options
+ * Precedence: `browser` > `os` > random pick from `STEALTH_BROWSER_POOL`.
  */
-export declare function getStealthSocketConfig(opts?: {
+export interface GetStealthSocketConfigOptions {
+    /**
+     * Override the OS / app name slot of the browser tuple. If supplied
+     * without `browser`, the OS replaces the first element of a randomly
+     * picked tuple — `[os, browser, version]`.
+     */
     os?: string;
-}): any;
+    /**
+     * Provide an explicit browser tuple. When set, takes precedence over
+     * `os` and the pool. Use this if you have a fingerprint you trust.
+     */
+    browser?: BrowserTuple;
+    /**
+     * Custom RNG. Defaults to `Math.random`. Useful for tests.
+     */
+    random?: () => number;
+}
 /**
- * Ramps presence from unavailable to available after a randomized delay.
- * Call this after socket connects. Returns a promise that resolves once
- * presence is set. Can be awaited or fire-and-forget.
+ * Returns a partial Baileys socket config tuned for stealth connect.
+ *
+ * - `markOnlineOnConnect` set to `false` so the socket joins without
+ *   broadcasting `available` (matches GOWA's `presence-on-connect=unavailable`).
+ * - `browser` is a randomized realistic tuple from `STEALTH_BROWSER_POOL`
+ *   unless overridden via `opts.browser` or `opts.os`.
  *
- * @param sock - Baileys socket instance (must have sendPresenceUpdate method)
- * @param opts.minDelayMs - Minimum delay in ms (default: 30000 = 30s)
- * @param opts.maxDelayMs - Maximum delay in ms (default: 90000 = 90s)
- * @param opts.targetState - Presence state to set after delay (default: 'available')
- * @returns Promise that resolves when presence is updated
+ * Merge the result into your `makeWASocket` options:
+ *
+ *   const sock = makeWASocket({ ...getStealthSocketConfig(), auth: state });
+ */
+export declare function getStealthSocketConfig(opts?: GetStealthSocketConfigOptions): StealthSocketConfig;
+/**
+ * Minimal structural type for the socket consumed by `rampPresenceAfterConnect`.
+ * Matches the shape used elsewhere in this library (e.g. `presenceChoreographer`).
  */
-export declare function rampPresenceAfterConnect(sock: any, opts?: {
+export interface PresenceCapableSocket {
+    sendPresenceUpdate: (state: string, jid?: string) => Promise<void> | void;
+}
+/**
+ * Options for `rampPresenceAfterConnect()`.
+ */
+export interface RampPresenceOptions {
+    /** Minimum delay before issuing the presence update, ms. Default: 30000. */
     minDelayMs?: number;
+    /** Maximum delay before issuing the presence update, ms. Default: 90000. */
     maxDelayMs?: number;
+    /** Presence state to set after the delay. Default: `'available'`. */
     targetState?: 'available' | 'unavailable' | 'composing' | 'recording' | 'paused';
-}): Promise<void>;
+    /**
+     * If set, cancels the pending timer and prevents the presence update.
+     * Use this when the socket disconnects before the ramp fires.
+     * Aborting causes the returned promise to reject with `AbortError`.
+     */
+    signal?: AbortSignal;
+    /** Custom RNG. Defaults to `Math.random`. Useful for tests. */
+    random?: () => number;
+}
+/**
+ * Custom error thrown when `rampPresenceAfterConnect` is aborted via signal.
+ * Mirrors DOM `AbortError` semantics so consumers can `instanceof` check.
+ */
+export declare class AbortError extends Error {
+    name: string;
+    constructor(message?: string);
+}
+/**
+ * Waits a randomized delay then calls `sock.sendPresenceUpdate(targetState)`.
+ *
+ * Supports `AbortSignal` — abort during the delay window cancels the timer
+ * and rejects the returned promise with `AbortError`. Aborting after the
+ * presence update has already been sent is a no-op.
+ *
+ * Caller is responsible for invoking abort when the socket disconnects;
+ * otherwise the post-delay `sendPresenceUpdate` may run against a dead
+ * socket.
+ */
+export declare function rampPresenceAfterConnect(sock: PresenceCapableSocket, opts?: RampPresenceOptions): Promise<void>;

package/dist/stealthConnect.js

@@ -1,48 +1,130 @@
 /**
- * Stealth Connect — Gradual presence ramp to reduce ban signals
+ * Stealth Connect — Reduce ban signal on socket connect + presence ramp
  *
  * Inspired by GOWA's --presence-on-connect=unavailable flag. Bots that
- * instantly snap online and start blasting messages look suspicious.
- * This helper connects without advertising "online" presence, then
- * gradually ramps to "available" after a randomized delay.
+ * snap online immediately and start blasting messages look suspicious to
+ * WhatsApp's anti-spam classifier. This module ships two helpers:
+ *
+ *   - `getStealthSocketConfig()` returns a partial Baileys socket config
+ *     that disables `markOnlineOnConnect` and provides a non-default
+ *     browser fingerprint (random pick from a small pool unless overridden).
+ *
+ *   - `rampPresenceAfterConnect()` waits a randomized delay, then issues
+ *     `sendPresenceUpdate('available')`. Supports `AbortSignal` so the
+ *     caller can cancel if the socket dies before the timer fires.
  *
  * Usage:
- *   const config = getStealthSocketConfig({ os: 'My Custom App' });
- *   const sock = makeWASocket({ ...config, ...otherOptions });
- *   await rampPresenceAfterConnect(sock, { minDelayMs: 45000, maxDelayMs: 120000 });
+ *   const config = getStealthSocketConfig({ os: 'MyApp' });
+ *   const sock = makeWASocket({ ...config, auth: state });
+ *
+ *   const ac = new AbortController();
+ *   sock.ev.on('connection.update', u => {
+ *     if (u.connection === 'close') ac.abort();
+ *   });
+ *   await rampPresenceAfterConnect(sock, { signal: ac.signal });
+ */
+/**
+ * Pool of realistic browser fingerprints.
+ *
+ * Values match formats actually emitted by WhatsApp Web clients in the wild.
+ * `getStealthSocketConfig()` picks one at random when caller does not supply
+ * an explicit `browser` or `os` option, so multiple consumers of the library
+ * do not all advertise an identical fingerprint (which would be trivially
+ * cluster-able by WhatsApp).
+ *
+ * Exported so callers can extend or override the pool if desired.
  */
+export const STEALTH_BROWSER_POOL = Object.freeze([
+    ['Mac OS', 'Chrome', '120.0.6099.109'],
+    ['Mac OS', 'Safari', '17.2.1'],
+    ['Windows', 'Chrome', '121.0.6167.85'],
+    ['Windows', 'Firefox', '122.0'],
+    ['Windows', 'Edge', '120.0.2210.144'],
+    ['Linux', 'Chrome', '120.0.6099.109'],
+    ['Linux', 'Firefox', '122.0'],
+    ['Ubuntu', 'Chrome', '121.0.6167.85'],
+]);
 /**
- * Returns socket configuration for stealth connect.
- * Sets markOnlineOnConnect=false and provides sensible browser defaults.
+ * Returns a partial Baileys socket config tuned for stealth connect.
  *
- * @param opts.os - Optional custom OS name for device fingerprint (default: 'Baileys')
- * @returns Partial socket config to merge into makeWASocket options
+ * - `markOnlineOnConnect` set to `false` so the socket joins without
+ *   broadcasting `available` (matches GOWA's `presence-on-connect=unavailable`).
+ * - `browser` is a randomized realistic tuple from `STEALTH_BROWSER_POOL`
+ *   unless overridden via `opts.browser` or `opts.os`.
+ *
+ * Merge the result into your `makeWASocket` options:
+ *
+ *   const sock = makeWASocket({ ...getStealthSocketConfig(), auth: state });
  */
 export function getStealthSocketConfig(opts) {
+    const random = opts?.random ?? Math.random;
+    let browser;
+    if (opts?.browser) {
+        browser = opts.browser;
+    }
+    else {
+        const pick = STEALTH_BROWSER_POOL[Math.floor(random() * STEALTH_BROWSER_POOL.length)];
+        // pick is guaranteed defined — pool is non-empty and frozen.
+        const tuple = pick;
+        if (opts?.os) {
+            browser = [opts.os, tuple[1], tuple[2]];
+        }
+        else {
+            browser = [tuple[0], tuple[1], tuple[2]];
+        }
+    }
     return {
         markOnlineOnConnect: false,
-        browser: ['Ubuntu', 'Chrome', '20.0.04'],
-        ...(opts?.os && { defaultQueryTimeoutMs: undefined }), // placeholder — actual os field lives in auth
+        browser,
     };
 }
 /**
- * Ramps presence from unavailable to available after a randomized delay.
- * Call this after socket connects. Returns a promise that resolves once
- * presence is set. Can be awaited or fire-and-forget.
- *
- * @param sock - Baileys socket instance (must have sendPresenceUpdate method)
- * @param opts.minDelayMs - Minimum delay in ms (default: 30000 = 30s)
- * @param opts.maxDelayMs - Maximum delay in ms (default: 90000 = 90s)
- * @param opts.targetState - Presence state to set after delay (default: 'available')
- * @returns Promise that resolves when presence is updated
+ * Custom error thrown when `rampPresenceAfterConnect` is aborted via signal.
+ * Mirrors DOM `AbortError` semantics so consumers can `instanceof` check.
+ */
+export class AbortError extends Error {
+    name = 'AbortError';
+    constructor(message = 'rampPresenceAfterConnect aborted') {
+        super(message);
+    }
+}
+/**
+ * Waits a randomized delay then calls `sock.sendPresenceUpdate(targetState)`.
+ *
+ * Supports `AbortSignal` — abort during the delay window cancels the timer
+ * and rejects the returned promise with `AbortError`. Aborting after the
+ * presence update has already been sent is a no-op.
+ *
+ * Caller is responsible for invoking abort when the socket disconnects;
+ * otherwise the post-delay `sendPresenceUpdate` may run against a dead
+ * socket.
  */
 export async function rampPresenceAfterConnect(sock, opts) {
     const minDelayMs = opts?.minDelayMs ?? 30000;
     const maxDelayMs = opts?.maxDelayMs ?? 90000;
     const targetState = opts?.targetState ?? 'available';
-    // Random delay in [minDelayMs, maxDelayMs]
-    const delayMs = Math.floor(Math.random() * (maxDelayMs - minDelayMs + 1)) + minDelayMs;
-    await new Promise((resolve) => setTimeout(resolve, delayMs));
-    // Send presence update (undefined = broadcast to all conversations)
+    const random = opts?.random ?? Math.random;
+    const signal = opts?.signal;
+    if (signal?.aborted) {
+        throw new AbortError();
+    }
+    const range = Math.max(0, maxDelayMs - minDelayMs);
+    const delayMs = Math.floor(random() * (range + 1)) + minDelayMs;
+    await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            if (signal) {
+                signal.removeEventListener('abort', onAbort);
+            }
+            resolve();
+        }, delayMs);
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(new AbortError());
+        };
+        if (signal) {
+            signal.addEventListener('abort', onAbort, { once: true });
+        }
+    });
+    // jid undefined => broadcast presence to all conversations
     await sock.sendPresenceUpdate(targetState, undefined);
 }

package/dist/wrapper.js

@@ -69,7 +69,9 @@ export function wrapSocket(sock, config, warmUpState, wrapOptions) {
                 for (const update of updates) {
                     // 463 error detection
                     if (update?.update?.messageStubParameters) {
-                        const params = update.update.messageStubParameters;
+                        const params = Array.isArray(update.update.messageStubParameters)
+                            ? update.update.messageStubParameters
+                            : [];
                         if (params.includes(463) || params.includes('463')) {
                             antiban.timelock.record463Error();
                         }
@@ -197,6 +199,10 @@ export function wrapSocket(sock, config, warmUpState, wrapOptions) {
     }
     // Create proxy that intercepts sendMessage
     const originalSendMessage = sock.sendMessage.bind(sock);
+    // Serializes beforeSend→afterSend so rate limiter accounting is accurate
+    // under concurrent sends. Without this, all concurrent callers read the same
+    // committed state before any afterSend records, bypassing per-minute limits.
+    let sendLock = Promise.resolve();
     const wrappedSendMessage = async (jid, content, options) => {
         /**
          * LID/PN Canonicalization — Normalize JID to canonical form
@@ -211,29 +217,36 @@ export function wrapSocket(sock, config, warmUpState, wrapOptions) {
         const canonicalJid = antiban.jidCanonicalizer?.canonicalizeTarget(jid) || jid;
         // Extract text content for rate limiter analysis
         const text = content?.text || content?.caption || content?.image?.caption || '';
-        const decision = await antiban.beforeSend(canonicalJid, text);
-        if (!decision.allowed) {
-            throw new Error(`[baileys-antiban] Message blocked: ${decision.reason}`);
-        }
-        // Apply delay
-        if (decision.delayMs > 0) {
-            await new Promise(resolve => setTimeout(resolve, decision.delayMs));
-        }
-        // Send message (using canonical JID)
-        try {
-            const result = await originalSendMessage(canonicalJid, content, options);
-            antiban.afterSend(canonicalJid, text);
-            antiban.timelock.registerKnownChat(canonicalJid);
-            // Clear retry tracking on successful send
-            if (result?.key?.id) {
-                antiban.retryTracker.clear(result.key.id);
+        // Chain this send onto the previous — each waits for the prior send's
+        // afterSend to commit before running its own beforeSend check.
+        const sendResult = sendLock.then(async () => {
+            const decision = await antiban.beforeSend(canonicalJid, text);
+            if (!decision.allowed) {
+                throw new Error(`[baileys-antiban] Message blocked: ${decision.reason}`);
             }
-            return result;
-        }
-        catch (error) {
-            antiban.afterSendFailed(error instanceof Error ? error.message : String(error));
-            throw error;
-        }
+            // Apply delay
+            if (decision.delayMs > 0) {
+                await new Promise(resolve => setTimeout(resolve, decision.delayMs));
+            }
+            // Send message (using canonical JID)
+            try {
+                const result = await originalSendMessage(canonicalJid, content, options);
+                antiban.afterSend(canonicalJid, text);
+                antiban.timelock.registerKnownChat(canonicalJid);
+                // Clear retry tracking on successful send
+                if (result?.key?.id) {
+                    antiban.retryTracker.clear(result.key.id);
+                }
+                return result;
+            }
+            catch (error) {
+                antiban.afterSendFailed(error instanceof Error ? error.message : String(error));
+                throw error;
+            }
+        });
+        // Advance the lock regardless of success/failure so the chain never stalls
+        sendLock = sendResult.then(() => { }, () => { });
+        return sendResult;
     };
     // Return enhanced socket
     const wrapped = Object.create(sock);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baileys-antiban",
-  "version": "3.8.0",
+  "version": "3.8.2",
   "description": "Anti-ban middleware for Baileys WhatsApp bots. Rate limiting, warmup, health monitor, LID resolver, disconnect classifier. Free Whapi.Cloud alternative.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -90,6 +90,7 @@
   "devDependencies": {
     "@types/jest": "^29.5.14",
     "@types/node": "^20.0.0",
+    "baileys": "github:WhiskeySockets/Baileys#dfad98f815feb771cc561f32707a00c6e085b1f1",
     "jest": "^29.7.0",
     "ts-jest": "^29.4.9",
     "tsx": "^4.21.0",