baileys-antiban 3.8.10 → 3.9.0

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.8.11] - 2026-05-19
+
+### Security
+- **persist.ts**: Resolve state file path to absolute (`path.resolve()`), reject null bytes. Add strict JSON shape validation (version, savedAt, knownChats types) before trusting loaded state — prevents type confusion from corrupt or tampered files.
+- **proxyRotator.ts**: Replace `(0, eval)('require')` and `(0, eval)('import.meta.url')` with `new Function()` on static literal strings in the ESM code path. Not user-controlled, but removes the indirect eval chain for static analysis and CSP compliance.
+
+### Fixed
+- **rateLimiter.ts**: Added LRU size cap (10,000 entries) to `identicalCount` Map. Time-window eviction alone allowed unbounded growth when sending many unique messages; oldest-by-lastSeen entries are now evicted when the cap is exceeded.
+- **antiban.ts**: Extend `mapLegacyToFlat()` to preserve `autoPauseAt`, `groupMultiplier`, `groupProfiles`, `persist` from flat top-level fields when legacy config detection fires — completing the coverage from 3.8.9.
+
+### Changed (3.8.10)
+- README: Expanded v3 flat config example with all `ResolvedConfig` fields; added correct `deafSession` wrapOptions (4th arg) example; marked nested Configuration section as deprecated.
+- Tests: 4 new v3 test cases covering `maxIdenticalMessages`/`burstAllowance` forwarding, mixed legacy+flat preservation, `getConfig()`.
+- CHANGELOG: Added missing 3.8.9 entry.
+
 ## [3.8.9] - 2026-05-19
 
 ### Fixed

package/dist/antiban.js

@@ -79,6 +79,15 @@ function mapLegacyToFlat(legacy) {
         flat.identicalMessageWindowMs = legacyAsFlat.identicalMessageWindowMs;
     if (flat.burstAllowance === undefined && typeof legacyAsFlat.burstAllowance === 'number')
         flat.burstAllowance = legacyAsFlat.burstAllowance;
+    // v3 fields that may coexist with legacy nested keys
+    if (flat.autoPauseAt === undefined && typeof legacyAsFlat.autoPauseAt === 'string')
+        flat.autoPauseAt = legacyAsFlat.autoPauseAt;
+    if (flat.groupMultiplier === undefined && typeof legacyAsFlat.groupMultiplier === 'number')
+        flat.groupMultiplier = legacyAsFlat.groupMultiplier;
+    if (flat.groupProfiles === undefined && typeof legacyAsFlat.groupProfiles === 'boolean')
+        flat.groupProfiles = legacyAsFlat.groupProfiles;
+    if (flat.persist === undefined && typeof legacyAsFlat.persist === 'string')
+        flat.persist = legacyAsFlat.persist;
     return flat;
 }
 export class AntiBan {
@@ -161,7 +170,10 @@ export class AntiBan {
                     console.log(`[baileys-antiban] ${status.recommendation}`);
                     status.reasons.forEach(r => console.log(`[baileys-antiban]   → ${r}`));
                 }
-                // Call original callback if present
+                if ((status.risk === 'high' || status.risk === 'critical') && cfg.onAtRisk) {
+                    cfg.onAtRisk(status);
+                }
+                cfg.onRiskChange?.(status);
                 legacyPassthrough?.health?.onRiskChange?.(status);
             },
         });
@@ -172,12 +184,14 @@ export class AntiBan {
                 if (this.logging) {
                     console.log(`[baileys-antiban] REACHOUT TIMELOCKED — ${state.enforcementType || 'unknown'}, expires ${state.expiresAt?.toISOString() || 'unknown'}`);
                 }
+                cfg.onTimelockDetected?.(state);
                 legacyPassthrough?.timelock?.onTimelockDetected?.(state);
             },
             onTimelockLifted: (state) => {
                 if (this.logging) {
                     console.log(`[baileys-antiban] Timelock lifted — resuming new contact messages`);
                 }
+                cfg.onTimelockLifted?.(state);
                 legacyPassthrough?.timelock?.onTimelockLifted?.(state);
             },
         });

package/dist/cjs/antiban.js

@@ -82,6 +82,15 @@ function mapLegacyToFlat(legacy) {
         flat.identicalMessageWindowMs = legacyAsFlat.identicalMessageWindowMs;
     if (flat.burstAllowance === undefined && typeof legacyAsFlat.burstAllowance === 'number')
         flat.burstAllowance = legacyAsFlat.burstAllowance;
+    // v3 fields that may coexist with legacy nested keys
+    if (flat.autoPauseAt === undefined && typeof legacyAsFlat.autoPauseAt === 'string')
+        flat.autoPauseAt = legacyAsFlat.autoPauseAt;
+    if (flat.groupMultiplier === undefined && typeof legacyAsFlat.groupMultiplier === 'number')
+        flat.groupMultiplier = legacyAsFlat.groupMultiplier;
+    if (flat.groupProfiles === undefined && typeof legacyAsFlat.groupProfiles === 'boolean')
+        flat.groupProfiles = legacyAsFlat.groupProfiles;
+    if (flat.persist === undefined && typeof legacyAsFlat.persist === 'string')
+        flat.persist = legacyAsFlat.persist;
     return flat;
 }
 class AntiBan {
@@ -164,7 +173,10 @@ class AntiBan {
                     console.log(`[baileys-antiban] ${status.recommendation}`);
                     status.reasons.forEach(r => console.log(`[baileys-antiban]   → ${r}`));
                 }
-                // Call original callback if present
+                if ((status.risk === 'high' || status.risk === 'critical') && cfg.onAtRisk) {
+                    cfg.onAtRisk(status);
+                }
+                cfg.onRiskChange?.(status);
                 legacyPassthrough?.health?.onRiskChange?.(status);
             },
         });
@@ -175,12 +187,14 @@ class AntiBan {
                 if (this.logging) {
                     console.log(`[baileys-antiban] REACHOUT TIMELOCKED — ${state.enforcementType || 'unknown'}, expires ${state.expiresAt?.toISOString() || 'unknown'}`);
                 }
+                cfg.onTimelockDetected?.(state);
                 legacyPassthrough?.timelock?.onTimelockDetected?.(state);
             },
             onTimelockLifted: (state) => {
                 if (this.logging) {
                     console.log(`[baileys-antiban] Timelock lifted — resuming new contact messages`);
                 }
+                cfg.onTimelockLifted?.(state);
                 legacyPassthrough?.timelock?.onTimelockLifted?.(state);
             },
         });

package/dist/cjs/persist.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.StateManager = void 0;
 const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const KNOWN_CHATS_MAX = 1000;
 const DEBOUNCE_MS = 5000;
 /**
@@ -48,13 +49,20 @@ class StateManager {
     path;
     debounceTimer = null;
     constructor(filePath) {
-        this.path = filePath;
+        // Resolve to absolute path and reject null bytes to prevent path injection
+        if (filePath.includes('\0'))
+            throw new Error('[baileys-antiban] Invalid state file path: null byte');
+        this.path = path.resolve(filePath);
     }
     load() {
         try {
             const raw = fs.readFileSync(this.path, 'utf-8');
             const parsed = JSON.parse(raw);
-            if (parsed.version !== 3) {
+            // Strict shape validation before trusting file content
+            if (typeof parsed !== 'object' || parsed === null ||
+                parsed.version !== 3 ||
+                typeof parsed.savedAt !== 'number' ||
+                !Array.isArray(parsed.knownChats)) {
                 console.warn('[baileys-antiban] WARN: corrupt state file or version mismatch, starting fresh');
                 return null;
             }

package/dist/cjs/proxyRotator.js

@@ -19,20 +19,19 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.proxyRotator = proxyRotator;
-// Create require function for loading optional peer dependencies
-// This function works in both ESM and CJS contexts
+// Load optional peer dependencies synchronously in both ESM and CJS builds.
+// CJS: native require is available. ESM: new Function() reads import.meta.url
+// without causing TypeScript parse errors in CJS compilation. The string passed
+// to new Function is a static literal — not user-controlled.
 function lazyRequire(moduleName) {
-    // In CJS: use native require
     if (typeof require !== 'undefined') {
         return require(moduleName);
     }
-    // In ESM: use createRequire with import.meta.url
-    // We use indirect eval to get import.meta.url to avoid parse errors in CJS
-    // @ts-ignore - ESM-only code path
-    const { createRequire } = (0, eval)('require')('node:module');
-    // @ts-ignore - ESM-only code path
-    const dynamicRequire = createRequire((0, eval)('import.meta.url'));
-    return dynamicRequire(moduleName);
+    // ESM path: new Function with static literal string avoids TS CJS-parse error on import.meta.
+    // Not user-controlled — both strings are compile-time constants.
+    const { createRequire } = (new Function('return require')())('node:module');
+    const metaUrl = new Function('return import.meta.url')();
+    return createRequire(metaUrl)(moduleName);
 }
 const NoopLogger = {
     info: () => { },

package/dist/cjs/rateLimiter.js

@@ -177,6 +177,15 @@ class RateLimiter {
                 this.identicalCount.delete(hash);
             }
         }
+        // LRU size cap — prevents unbounded growth when sending many unique messages.
+        // Evict oldest-by-lastSeen entries when map exceeds 10,000 entries.
+        const IDENTICAL_COUNT_MAX = 10_000;
+        if (this.identicalCount.size > IDENTICAL_COUNT_MAX) {
+            const sorted = [...this.identicalCount.entries()].sort(([, a], [, b]) => a.lastSeen - b.lastSeen);
+            const excess = this.identicalCount.size - IDENTICAL_COUNT_MAX;
+            for (let i = 0; i < excess; i++)
+                this.identicalCount.delete(sorted[i][0]);
+        }
     }
     /** Random delay between min and max (gaussian-ish distribution) */
     jitter(min, max) {

package/dist/cjs/wrapper.js

@@ -260,7 +260,19 @@ function wrapSocket(sock, config, warmUpState, wrapOptions) {
                 return result;
             }
             catch (error) {
-                antiban.afterSendFailed(error instanceof Error ? error.message : String(error));
+                // Baileys PR #2587: partial-encrypt Boom now carries structured data:
+                //   error.data.failed[]   — per-recipient { jid, error } failures
+                //   error.data.firstCause — most likely root cause string
+                // Extract for richer health-monitor diagnostics vs plain error.message.
+                const boomData = error?.data;
+                if (boomData?.failed?.length) {
+                    const cause = boomData.firstCause ?? 'unknown';
+                    const failedJids = boomData.failed.map((f) => f.jid).join(', ');
+                    antiban.afterSendFailed(`encrypt-all-failed firstCause=${cause} jids=[${failedJids}]`);
+                }
+                else {
+                    antiban.afterSendFailed(error instanceof Error ? error.message : String(error));
+                }
                 throw error;
             }
         });

package/dist/persist.js

@@ -1,4 +1,5 @@
 import * as fs from 'fs';
+import * as path from 'path';
 const KNOWN_CHATS_MAX = 1000;
 const DEBOUNCE_MS = 5000;
 /**
@@ -12,13 +13,20 @@ export class StateManager {
     path;
     debounceTimer = null;
     constructor(filePath) {
-        this.path = filePath;
+        // Resolve to absolute path and reject null bytes to prevent path injection
+        if (filePath.includes('\0'))
+            throw new Error('[baileys-antiban] Invalid state file path: null byte');
+        this.path = path.resolve(filePath);
     }
     load() {
         try {
             const raw = fs.readFileSync(this.path, 'utf-8');
             const parsed = JSON.parse(raw);
-            if (parsed.version !== 3) {
+            // Strict shape validation before trusting file content
+            if (typeof parsed !== 'object' || parsed === null ||
+                parsed.version !== 3 ||
+                typeof parsed.savedAt !== 'number' ||
+                !Array.isArray(parsed.knownChats)) {
                 console.warn('[baileys-antiban] WARN: corrupt state file or version mismatch, starting fresh');
                 return null;
             }

package/dist/presets.d.ts

@@ -1,4 +1,5 @@
-import type { BanRiskLevel } from './health.js';
+import type { BanRiskLevel, HealthStatus } from './health.js';
+import type { TimelockState } from './timelockGuard.js';
 export interface ResolvedConfig {
     maxPerMinute: number;
     maxPerHour: number;
@@ -18,6 +19,10 @@ export interface ResolvedConfig {
     groupProfiles: boolean;
     persist?: string;
     logging: boolean;
+    onAtRisk?: (status: HealthStatus) => void;
+    onRiskChange?: (status: HealthStatus) => void;
+    onTimelockDetected?: (state: TimelockState) => void;
+    onTimelockLifted?: (state: TimelockState) => void;
 }
 export type PresetName = 'conservative' | 'moderate' | 'aggressive' | 'high-volume';
 export type AntiBanInput = PresetName | Partial<ResolvedConfig & {

package/dist/proxyRotator.js

@@ -16,20 +16,19 @@
  * @author Kobus Wentzel <kobie@pop.co.za>
  * @license MIT
  */
-// Create require function for loading optional peer dependencies
-// This function works in both ESM and CJS contexts
+// Load optional peer dependencies synchronously in both ESM and CJS builds.
+// CJS: native require is available. ESM: new Function() reads import.meta.url
+// without causing TypeScript parse errors in CJS compilation. The string passed
+// to new Function is a static literal — not user-controlled.
 function lazyRequire(moduleName) {
-    // In CJS: use native require
     if (typeof require !== 'undefined') {
         return require(moduleName);
     }
-    // In ESM: use createRequire with import.meta.url
-    // We use indirect eval to get import.meta.url to avoid parse errors in CJS
-    // @ts-ignore - ESM-only code path
-    const { createRequire } = (0, eval)('require')('node:module');
-    // @ts-ignore - ESM-only code path
-    const dynamicRequire = createRequire((0, eval)('import.meta.url'));
-    return dynamicRequire(moduleName);
+    // ESM path: new Function with static literal string avoids TS CJS-parse error on import.meta.
+    // Not user-controlled — both strings are compile-time constants.
+    const { createRequire } = (new Function('return require')())('node:module');
+    const metaUrl = new Function('return import.meta.url')();
+    return createRequire(metaUrl)(moduleName);
 }
 const NoopLogger = {
     info: () => { },

package/dist/rateLimiter.js

@@ -174,6 +174,15 @@ export class RateLimiter {
                 this.identicalCount.delete(hash);
             }
         }
+        // LRU size cap — prevents unbounded growth when sending many unique messages.
+        // Evict oldest-by-lastSeen entries when map exceeds 10,000 entries.
+        const IDENTICAL_COUNT_MAX = 10_000;
+        if (this.identicalCount.size > IDENTICAL_COUNT_MAX) {
+            const sorted = [...this.identicalCount.entries()].sort(([, a], [, b]) => a.lastSeen - b.lastSeen);
+            const excess = this.identicalCount.size - IDENTICAL_COUNT_MAX;
+            for (let i = 0; i < excess; i++)
+                this.identicalCount.delete(sorted[i][0]);
+        }
     }
     /** Random delay between min and max (gaussian-ish distribution) */
     jitter(min, max) {

package/dist/wrapper.js

@@ -257,7 +257,19 @@ export function wrapSocket(sock, config, warmUpState, wrapOptions) {
                 return result;
             }
             catch (error) {
-                antiban.afterSendFailed(error instanceof Error ? error.message : String(error));
+                // Baileys PR #2587: partial-encrypt Boom now carries structured data:
+                //   error.data.failed[]   — per-recipient { jid, error } failures
+                //   error.data.firstCause — most likely root cause string
+                // Extract for richer health-monitor diagnostics vs plain error.message.
+                const boomData = error?.data;
+                if (boomData?.failed?.length) {
+                    const cause = boomData.firstCause ?? 'unknown';
+                    const failedJids = boomData.failed.map((f) => f.jid).join(', ');
+                    antiban.afterSendFailed(`encrypt-all-failed firstCause=${cause} jids=[${failedJids}]`);
+                }
+                else {
+                    antiban.afterSendFailed(error instanceof Error ? error.message : String(error));
+                }
                 throw error;
             }
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baileys-antiban",
-  "version": "3.8.10",
+  "version": "3.9.0",
   "description": "Anti-ban middleware for Baileys WhatsApp bots. Rate limiting, warmup, health monitor, LID resolver, disconnect classifier. Free Whapi.Cloud alternative.",
   "main": "dist/cjs/index.js",
   "types": "dist/index.d.ts",
@@ -29,7 +29,7 @@
     "prepublishOnly": "npm run build"
   },
   "bin": {
-    "baileys-antiban": "./dist/cli.js"
+    "baileys-antiban": "dist/cli.js"
   },
   "keywords": [
     "baileys",
@@ -61,7 +61,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/kobie3717/baileys-antiban"
+    "url": "git+https://github.com/kobie3717/baileys-antiban.git"
   },
   "bugs": {
     "url": "https://github.com/kobie3717/baileys-antiban/issues"
@@ -90,7 +90,7 @@
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
-    "@whiskeysockets/baileys": "^7.0.0-rc11",
+    "@whiskeysockets/baileys": "7.0.0-rc12",
     "baileys": "github:WhiskeySockets/Baileys#dfad98f815feb771cc561f32707a00c6e085b1f1",
     "tsx": "^4.21.0",
     "typescript": "^5.0.0",