baileys-antiban 3.8.11 → 3.9.0

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.8.11] - 2026-05-19
+
+### Security
+- **persist.ts**: Resolve state file path to absolute (`path.resolve()`), reject null bytes. Add strict JSON shape validation (version, savedAt, knownChats types) before trusting loaded state — prevents type confusion from corrupt or tampered files.
+- **proxyRotator.ts**: Replace `(0, eval)('require')` and `(0, eval)('import.meta.url')` with `new Function()` on static literal strings in the ESM code path. Not user-controlled, but removes the indirect eval chain for static analysis and CSP compliance.
+
+### Fixed
+- **rateLimiter.ts**: Added LRU size cap (10,000 entries) to `identicalCount` Map. Time-window eviction alone allowed unbounded growth when sending many unique messages; oldest-by-lastSeen entries are now evicted when the cap is exceeded.
+- **antiban.ts**: Extend `mapLegacyToFlat()` to preserve `autoPauseAt`, `groupMultiplier`, `groupProfiles`, `persist` from flat top-level fields when legacy config detection fires — completing the coverage from 3.8.9.
+
+### Changed (3.8.10)
+- README: Expanded v3 flat config example with all `ResolvedConfig` fields; added correct `deafSession` wrapOptions (4th arg) example; marked nested Configuration section as deprecated.
+- Tests: 4 new v3 test cases covering `maxIdenticalMessages`/`burstAllowance` forwarding, mixed legacy+flat preservation, `getConfig()`.
+- CHANGELOG: Added missing 3.8.9 entry.
+
 ## [3.8.9] - 2026-05-19
 
 ### Fixed

package/dist/antiban.js

@@ -170,7 +170,10 @@ export class AntiBan {
                     console.log(`[baileys-antiban] ${status.recommendation}`);
                     status.reasons.forEach(r => console.log(`[baileys-antiban]   → ${r}`));
                 }
-                // Call original callback if present
+                if ((status.risk === 'high' || status.risk === 'critical') && cfg.onAtRisk) {
+                    cfg.onAtRisk(status);
+                }
+                cfg.onRiskChange?.(status);
                 legacyPassthrough?.health?.onRiskChange?.(status);
             },
         });
@@ -181,12 +184,14 @@ export class AntiBan {
                 if (this.logging) {
                     console.log(`[baileys-antiban] REACHOUT TIMELOCKED — ${state.enforcementType || 'unknown'}, expires ${state.expiresAt?.toISOString() || 'unknown'}`);
                 }
+                cfg.onTimelockDetected?.(state);
                 legacyPassthrough?.timelock?.onTimelockDetected?.(state);
             },
             onTimelockLifted: (state) => {
                 if (this.logging) {
                     console.log(`[baileys-antiban] Timelock lifted — resuming new contact messages`);
                 }
+                cfg.onTimelockLifted?.(state);
                 legacyPassthrough?.timelock?.onTimelockLifted?.(state);
             },
         });

package/dist/cjs/antiban.js

@@ -173,7 +173,10 @@ class AntiBan {
                     console.log(`[baileys-antiban] ${status.recommendation}`);
                     status.reasons.forEach(r => console.log(`[baileys-antiban]   → ${r}`));
                 }
-                // Call original callback if present
+                if ((status.risk === 'high' || status.risk === 'critical') && cfg.onAtRisk) {
+                    cfg.onAtRisk(status);
+                }
+                cfg.onRiskChange?.(status);
                 legacyPassthrough?.health?.onRiskChange?.(status);
             },
         });
@@ -184,12 +187,14 @@ class AntiBan {
                 if (this.logging) {
                     console.log(`[baileys-antiban] REACHOUT TIMELOCKED — ${state.enforcementType || 'unknown'}, expires ${state.expiresAt?.toISOString() || 'unknown'}`);
                 }
+                cfg.onTimelockDetected?.(state);
                 legacyPassthrough?.timelock?.onTimelockDetected?.(state);
             },
             onTimelockLifted: (state) => {
                 if (this.logging) {
                     console.log(`[baileys-antiban] Timelock lifted — resuming new contact messages`);
                 }
+                cfg.onTimelockLifted?.(state);
                 legacyPassthrough?.timelock?.onTimelockLifted?.(state);
             },
         });

package/dist/cjs/wrapper.js

@@ -260,7 +260,19 @@ function wrapSocket(sock, config, warmUpState, wrapOptions) {
                 return result;
             }
             catch (error) {
-                antiban.afterSendFailed(error instanceof Error ? error.message : String(error));
+                // Baileys PR #2587: partial-encrypt Boom now carries structured data:
+                //   error.data.failed[]   — per-recipient { jid, error } failures
+                //   error.data.firstCause — most likely root cause string
+                // Extract for richer health-monitor diagnostics vs plain error.message.
+                const boomData = error?.data;
+                if (boomData?.failed?.length) {
+                    const cause = boomData.firstCause ?? 'unknown';
+                    const failedJids = boomData.failed.map((f) => f.jid).join(', ');
+                    antiban.afterSendFailed(`encrypt-all-failed firstCause=${cause} jids=[${failedJids}]`);
+                }
+                else {
+                    antiban.afterSendFailed(error instanceof Error ? error.message : String(error));
+                }
                 throw error;
             }
         });

package/dist/presets.d.ts

@@ -1,4 +1,5 @@
-import type { BanRiskLevel } from './health.js';
+import type { BanRiskLevel, HealthStatus } from './health.js';
+import type { TimelockState } from './timelockGuard.js';
 export interface ResolvedConfig {
     maxPerMinute: number;
     maxPerHour: number;
@@ -18,6 +19,10 @@ export interface ResolvedConfig {
     groupProfiles: boolean;
     persist?: string;
     logging: boolean;
+    onAtRisk?: (status: HealthStatus) => void;
+    onRiskChange?: (status: HealthStatus) => void;
+    onTimelockDetected?: (state: TimelockState) => void;
+    onTimelockLifted?: (state: TimelockState) => void;
 }
 export type PresetName = 'conservative' | 'moderate' | 'aggressive' | 'high-volume';
 export type AntiBanInput = PresetName | Partial<ResolvedConfig & {

package/dist/wrapper.js

@@ -257,7 +257,19 @@ export function wrapSocket(sock, config, warmUpState, wrapOptions) {
                 return result;
             }
             catch (error) {
-                antiban.afterSendFailed(error instanceof Error ? error.message : String(error));
+                // Baileys PR #2587: partial-encrypt Boom now carries structured data:
+                //   error.data.failed[]   — per-recipient { jid, error } failures
+                //   error.data.firstCause — most likely root cause string
+                // Extract for richer health-monitor diagnostics vs plain error.message.
+                const boomData = error?.data;
+                if (boomData?.failed?.length) {
+                    const cause = boomData.firstCause ?? 'unknown';
+                    const failedJids = boomData.failed.map((f) => f.jid).join(', ');
+                    antiban.afterSendFailed(`encrypt-all-failed firstCause=${cause} jids=[${failedJids}]`);
+                }
+                else {
+                    antiban.afterSendFailed(error instanceof Error ? error.message : String(error));
+                }
                 throw error;
             }
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baileys-antiban",
-  "version": "3.8.11",
+  "version": "3.9.0",
   "description": "Anti-ban middleware for Baileys WhatsApp bots. Rate limiting, warmup, health monitor, LID resolver, disconnect classifier. Free Whapi.Cloud alternative.",
   "main": "dist/cjs/index.js",
   "types": "dist/index.d.ts",
@@ -29,7 +29,7 @@
     "prepublishOnly": "npm run build"
   },
   "bin": {
-    "baileys-antiban": "./dist/cli.js"
+    "baileys-antiban": "dist/cli.js"
   },
   "keywords": [
     "baileys",
@@ -61,7 +61,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/kobie3717/baileys-antiban"
+    "url": "git+https://github.com/kobie3717/baileys-antiban.git"
   },
   "bugs": {
     "url": "https://github.com/kobie3717/baileys-antiban/issues"
@@ -90,7 +90,7 @@
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
-    "@whiskeysockets/baileys": "^7.0.0-rc11",
+    "@whiskeysockets/baileys": "7.0.0-rc12",
     "baileys": "github:WhiskeySockets/Baileys#dfad98f815feb771cc561f32707a00c6e085b1f1",
     "tsx": "^4.21.0",
     "typescript": "^5.0.0",