baileys-antiban 3.8.9 → 3.8.11

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.8.9] - 2026-05-19
+
+### Fixed
+- **`maxIdenticalMessages`, `identicalMessageWindowMs`, `burstAllowance` silently ignored.** These fields were missing from `ResolvedConfig` so passing them in flat config had no effect — the `RateLimiter` used its hardcoded defaults (3/3/3600000). All three are now in `ResolvedConfig`, set via preset defaults, and forwarded to `RateLimiter`. Reported in #8.
+- **Flat top-level fields dropped when legacy config is detected.** If a config object contained any nested key (`health`, `timelock`, `jidCanonicalizer`, `lidResolver`, etc.), `isLegacyConfig()` returned true and `mapLegacyToFlat()` only extracted fields from nested sub-objects — silently dropping flat top-level fields like `warmUpDays`, `day1Limit`, `growthFactor`, `inactivityThresholdHours`, `maxIdenticalMessages`, `burstAllowance`. Mixed configs (flat rate/warmup fields + nested callback objects) now preserve the flat fields correctly. Reported in #8.
+
+### Added
+- **`AntiBan.getConfig()`** — returns a copy of the effective resolved config after preset merging and defaults. Useful for debugging which values are actually in use.
+- **Preset defaults for new fields** — `maxIdenticalMessages`: 3/5/10/20, `identicalMessageWindowMs`: 3600000 (all presets), `burstAllowance`: 3/5/8/15 for conservative/moderate/aggressive/high-volume.
+
 ## [3.8.8] - 2026-05-15
 
 ### Added

package/README.md

@@ -574,14 +574,38 @@ const ab = new AntiBan();
 // Or pick a preset
 const ab = new AntiBan('moderate');
 
-// Full control
+// Full control — all ResolvedConfig fields (import ResolvedConfig for type safety)
 const ab = new AntiBan({
-  preset: 'moderate',
+  preset: 'moderate',            // base preset: conservative|moderate|aggressive|high-volume
+  // Rate limits
+  maxPerMinute: 15,              // override any field from the preset
+  maxPerHour: 400,
+  maxPerDay: 2000,
+  minDelayMs: 1000,
+  maxDelayMs: 4000,
+  newChatDelayMs: 2500,
+  // Identical message protection
+  maxIdenticalMessages: 5,       // block after N identical msgs in window (default: 5)
+  identicalMessageWindowMs: 3600000, // tracking window in ms (default: 1h)
+  burstAllowance: 5,             // fast messages before throttle kicks in
+  // Warm-up
+  warmupDays: 7,
+  day1Limit: 20,
+  growthFactor: 1.8,
+  inactivityThresholdHours: 72,
+  // Health
+  autoPauseAt: 'high',          // pause at: low|medium|high|critical
+  // Groups
+  groupProfiles: true,
+  groupMultiplier: 0.7,
+  // Persistence
   persist: './antiban-state.json',  // survives restarts
-  groupProfiles: true,               // stricter limits for groups
-  maxPerMinute: 15,                  // override any value
+  logging: true,
 });
 
+// Debug: see the effective config after preset merging
+console.log(ab.getConfig());
+
 // Usage unchanged
 const result = await ab.beforeSend(jid, text);
 if (result.allowed) {
@@ -637,7 +661,30 @@ try {
 }
 ```
 
-## Quick Start (Legacy)
+### `wrapSocket` with optional features
+
+`deafSession` (deaf-session detector) and `autoRespondToIncoming` are **wrapOptions** — the 4th argument to `wrapSocket`, separate from the antiban config:
+
+```typescript
+import { wrapSocket } from 'baileys-antiban';
+
+const safeSock = wrapSocket(
+  sock,
+  { maxPerMinute: 15, autoPauseAt: 'high' },  // 2nd: AntiBanConfig (flat)
+  undefined,                                    // 3rd: warmUpState (or pass saved state)
+  {                                             // 4th: WrapSocketOptions
+    deafSession: {
+      timeoutMs: 300000,       // declare deaf after 5min without incoming msgs
+      minUptimeMs: 120000,     // must be up 2min before deaf detection starts
+      autoReconnect: true,
+      onDeafSession: () => { /* reconnect logic */ },
+    },
+    autoRespondToIncoming: false,
+  }
+);
+```
+
+## Quick Start (Legacy — v2 API, still works)
 
 ### Option 1: Wrap Your Socket (Easiest)
 
@@ -696,9 +743,9 @@ sock.ev.on('connection.update', ({ connection, lastDisconnect }) => {
 });
 ```
 
-## Configuration
+## Configuration (Legacy nested format — deprecated)
 
-All options are optional — defaults are conservative and safe.
+> **Use the flat config in Quick Start (v3) above instead.** The nested format below still works but triggers a deprecation warning. Callbacks (`onRiskChange`, `onTimelockDetected`, `onTimelockLifted`) and advanced options for `jidCanonicalizer`/`lidResolver` currently still require the nested format — flat equivalents planned for v3.9.
 
 ```typescript
 import { AntiBan } from 'baileys-antiban';

package/dist/antiban.js

@@ -79,6 +79,15 @@ function mapLegacyToFlat(legacy) {
         flat.identicalMessageWindowMs = legacyAsFlat.identicalMessageWindowMs;
     if (flat.burstAllowance === undefined && typeof legacyAsFlat.burstAllowance === 'number')
         flat.burstAllowance = legacyAsFlat.burstAllowance;
+    // v3 fields that may coexist with legacy nested keys
+    if (flat.autoPauseAt === undefined && typeof legacyAsFlat.autoPauseAt === 'string')
+        flat.autoPauseAt = legacyAsFlat.autoPauseAt;
+    if (flat.groupMultiplier === undefined && typeof legacyAsFlat.groupMultiplier === 'number')
+        flat.groupMultiplier = legacyAsFlat.groupMultiplier;
+    if (flat.groupProfiles === undefined && typeof legacyAsFlat.groupProfiles === 'boolean')
+        flat.groupProfiles = legacyAsFlat.groupProfiles;
+    if (flat.persist === undefined && typeof legacyAsFlat.persist === 'string')
+        flat.persist = legacyAsFlat.persist;
     return flat;
 }
 export class AntiBan {

package/dist/cjs/antiban.js

@@ -82,6 +82,15 @@ function mapLegacyToFlat(legacy) {
         flat.identicalMessageWindowMs = legacyAsFlat.identicalMessageWindowMs;
     if (flat.burstAllowance === undefined && typeof legacyAsFlat.burstAllowance === 'number')
         flat.burstAllowance = legacyAsFlat.burstAllowance;
+    // v3 fields that may coexist with legacy nested keys
+    if (flat.autoPauseAt === undefined && typeof legacyAsFlat.autoPauseAt === 'string')
+        flat.autoPauseAt = legacyAsFlat.autoPauseAt;
+    if (flat.groupMultiplier === undefined && typeof legacyAsFlat.groupMultiplier === 'number')
+        flat.groupMultiplier = legacyAsFlat.groupMultiplier;
+    if (flat.groupProfiles === undefined && typeof legacyAsFlat.groupProfiles === 'boolean')
+        flat.groupProfiles = legacyAsFlat.groupProfiles;
+    if (flat.persist === undefined && typeof legacyAsFlat.persist === 'string')
+        flat.persist = legacyAsFlat.persist;
     return flat;
 }
 class AntiBan {

package/dist/cjs/persist.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.StateManager = void 0;
 const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const KNOWN_CHATS_MAX = 1000;
 const DEBOUNCE_MS = 5000;
 /**
@@ -48,13 +49,20 @@ class StateManager {
     path;
     debounceTimer = null;
     constructor(filePath) {
-        this.path = filePath;
+        // Resolve to absolute path and reject null bytes to prevent path injection
+        if (filePath.includes('\0'))
+            throw new Error('[baileys-antiban] Invalid state file path: null byte');
+        this.path = path.resolve(filePath);
     }
     load() {
         try {
             const raw = fs.readFileSync(this.path, 'utf-8');
             const parsed = JSON.parse(raw);
-            if (parsed.version !== 3) {
+            // Strict shape validation before trusting file content
+            if (typeof parsed !== 'object' || parsed === null ||
+                parsed.version !== 3 ||
+                typeof parsed.savedAt !== 'number' ||
+                !Array.isArray(parsed.knownChats)) {
                 console.warn('[baileys-antiban] WARN: corrupt state file or version mismatch, starting fresh');
                 return null;
             }

package/dist/cjs/proxyRotator.js

@@ -19,20 +19,19 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.proxyRotator = proxyRotator;
-// Create require function for loading optional peer dependencies
-// This function works in both ESM and CJS contexts
+// Load optional peer dependencies synchronously in both ESM and CJS builds.
+// CJS: native require is available. ESM: new Function() reads import.meta.url
+// without causing TypeScript parse errors in CJS compilation. The string passed
+// to new Function is a static literal — not user-controlled.
 function lazyRequire(moduleName) {
-    // In CJS: use native require
     if (typeof require !== 'undefined') {
         return require(moduleName);
     }
-    // In ESM: use createRequire with import.meta.url
-    // We use indirect eval to get import.meta.url to avoid parse errors in CJS
-    // @ts-ignore - ESM-only code path
-    const { createRequire } = (0, eval)('require')('node:module');
-    // @ts-ignore - ESM-only code path
-    const dynamicRequire = createRequire((0, eval)('import.meta.url'));
-    return dynamicRequire(moduleName);
+    // ESM path: new Function with static literal string avoids TS CJS-parse error on import.meta.
+    // Not user-controlled — both strings are compile-time constants.
+    const { createRequire } = (new Function('return require')())('node:module');
+    const metaUrl = new Function('return import.meta.url')();
+    return createRequire(metaUrl)(moduleName);
 }
 const NoopLogger = {
     info: () => { },

package/dist/cjs/rateLimiter.js

@@ -177,6 +177,15 @@ class RateLimiter {
                 this.identicalCount.delete(hash);
             }
         }
+        // LRU size cap — prevents unbounded growth when sending many unique messages.
+        // Evict oldest-by-lastSeen entries when map exceeds 10,000 entries.
+        const IDENTICAL_COUNT_MAX = 10_000;
+        if (this.identicalCount.size > IDENTICAL_COUNT_MAX) {
+            const sorted = [...this.identicalCount.entries()].sort(([, a], [, b]) => a.lastSeen - b.lastSeen);
+            const excess = this.identicalCount.size - IDENTICAL_COUNT_MAX;
+            for (let i = 0; i < excess; i++)
+                this.identicalCount.delete(sorted[i][0]);
+        }
     }
     /** Random delay between min and max (gaussian-ish distribution) */
     jitter(min, max) {

package/dist/persist.js

@@ -1,4 +1,5 @@
 import * as fs from 'fs';
+import * as path from 'path';
 const KNOWN_CHATS_MAX = 1000;
 const DEBOUNCE_MS = 5000;
 /**
@@ -12,13 +13,20 @@ export class StateManager {
     path;
     debounceTimer = null;
     constructor(filePath) {
-        this.path = filePath;
+        // Resolve to absolute path and reject null bytes to prevent path injection
+        if (filePath.includes('\0'))
+            throw new Error('[baileys-antiban] Invalid state file path: null byte');
+        this.path = path.resolve(filePath);
     }
     load() {
         try {
             const raw = fs.readFileSync(this.path, 'utf-8');
             const parsed = JSON.parse(raw);
-            if (parsed.version !== 3) {
+            // Strict shape validation before trusting file content
+            if (typeof parsed !== 'object' || parsed === null ||
+                parsed.version !== 3 ||
+                typeof parsed.savedAt !== 'number' ||
+                !Array.isArray(parsed.knownChats)) {
                 console.warn('[baileys-antiban] WARN: corrupt state file or version mismatch, starting fresh');
                 return null;
             }

package/dist/proxyRotator.js

@@ -16,20 +16,19 @@
  * @author Kobus Wentzel <kobie@pop.co.za>
  * @license MIT
  */
-// Create require function for loading optional peer dependencies
-// This function works in both ESM and CJS contexts
+// Load optional peer dependencies synchronously in both ESM and CJS builds.
+// CJS: native require is available. ESM: new Function() reads import.meta.url
+// without causing TypeScript parse errors in CJS compilation. The string passed
+// to new Function is a static literal — not user-controlled.
 function lazyRequire(moduleName) {
-    // In CJS: use native require
     if (typeof require !== 'undefined') {
         return require(moduleName);
     }
-    // In ESM: use createRequire with import.meta.url
-    // We use indirect eval to get import.meta.url to avoid parse errors in CJS
-    // @ts-ignore - ESM-only code path
-    const { createRequire } = (0, eval)('require')('node:module');
-    // @ts-ignore - ESM-only code path
-    const dynamicRequire = createRequire((0, eval)('import.meta.url'));
-    return dynamicRequire(moduleName);
+    // ESM path: new Function with static literal string avoids TS CJS-parse error on import.meta.
+    // Not user-controlled — both strings are compile-time constants.
+    const { createRequire } = (new Function('return require')())('node:module');
+    const metaUrl = new Function('return import.meta.url')();
+    return createRequire(metaUrl)(moduleName);
 }
 const NoopLogger = {
     info: () => { },

package/dist/rateLimiter.js

@@ -174,6 +174,15 @@ export class RateLimiter {
                 this.identicalCount.delete(hash);
             }
         }
+        // LRU size cap — prevents unbounded growth when sending many unique messages.
+        // Evict oldest-by-lastSeen entries when map exceeds 10,000 entries.
+        const IDENTICAL_COUNT_MAX = 10_000;
+        if (this.identicalCount.size > IDENTICAL_COUNT_MAX) {
+            const sorted = [...this.identicalCount.entries()].sort(([, a], [, b]) => a.lastSeen - b.lastSeen);
+            const excess = this.identicalCount.size - IDENTICAL_COUNT_MAX;
+            for (let i = 0; i < excess; i++)
+                this.identicalCount.delete(sorted[i][0]);
+        }
     }
     /** Random delay between min and max (gaussian-ish distribution) */
     jitter(min, max) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baileys-antiban",
-  "version": "3.8.9",
+  "version": "3.8.11",
   "description": "Anti-ban middleware for Baileys WhatsApp bots. Rate limiting, warmup, health monitor, LID resolver, disconnect classifier. Free Whapi.Cloud alternative.",
   "main": "dist/cjs/index.js",
   "types": "dist/index.d.ts",