levix-bot 2.0.0 → 2.0.1

package/app.cjs

@@ -40,6 +40,27 @@ function isAllowedOrigin(origin, host) {
   return origin === `http://${host}` || origin === `https://${host}`;
 }
 
+// Browsers may legitimately serialize the Origin header as the literal string
+// "null" for a same-origin navigation in an opaque-origin context. Treating
+// that as a foreign origin breaks first-run/login forms in real browsers even
+// though Sec-Fetch-Site still proves the navigation is same-origin. Fetch
+// metadata headers are forbidden to page JavaScript, so they are a stronger
+// browser signal than trying to special-case the string "null" globally.
+function isAllowedMutationRequest(req) {
+  const origin = req.get("origin");
+  const host = req.get("host");
+
+  // Preserve the explicit dashboard_origin escape hatch before consulting
+  // fetch metadata: a deliberately separate dashboard can be cross-site.
+  if (origin && origin !== "null" && isAllowedOrigin(origin, host)) return true;
+
+  const fetchSite = req.get("sec-fetch-site");
+  if (fetchSite === "same-origin") return true;
+  if (fetchSite === "cross-site") return false;
+
+  return isAllowedOrigin(origin, host);
+}
+
 // serveClient reads the browser bundle out of node_modules on every request,
 // which a packaged build has no way to do. We vendor it in public/ instead —
 // same reason qrcode.min.js is there rather than on a CDN.
@@ -91,7 +112,7 @@ app.use((req, res, next) => {
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 app.use((req, res, next) => {
   if (SAFE_METHODS.has(req.method)) return next();
-  if (isAllowedOrigin(req.get("origin"), req.get("host"))) return next();
+  if (isAllowedMutationRequest(req)) return next();
   return res.status(403).json({ error: "Cross-origin request rejected" });
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "levix-bot",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "A self-hosted personal WhatsApp bot with an AI agent, group moderation and a web control panel.",
   "main": "src/index.js",
   "scripts": {
@@ -27,22 +27,26 @@
   "type": "module",
   "dependencies": {
     "@google/generative-ai": "^0.24.1",
-    "@whiskeysockets/baileys": "7.0.0-rc13",
+    "@sefinek/google-tts-api": "^2.1.15",
+    "@whiskeysockets/baileys": "7.0.0-rc14",
     "axios": "^1.9.0",
     "ejs": "^3.1.10",
     "express": "^5.1.0",
     "express-session": "^1.18.1",
-    "ffmpeg-static": "^5.2.0",
-    "fluent-ffmpeg": "^2.1.3",
+    "ffmpeg-static": "^5.3.0",
     "node-cache": "^5.1.2",
     "node-cron": "^4.1.0",
-    "node-gtts": "^2.0.2",
     "pino": "^9.7.0",
     "pino-pretty": "^13.0.0",
     "qrcode": "^1.5.4",
     "qrcode-terminal": "^0.12.0",
-    "socket.io": "^4.8.1",
-    "uuid": "^11.1.0"
+    "socket.io": "^4.8.1"
+  },
+  "allowScripts": {
+    "@whiskeysockets/baileys": true,
+    "esbuild": true,
+    "ffmpeg-static": true,
+    "protobufjs": true
   },
   "repository": {
     "type": "git",

package/src/commands/autoschedule.cjs

@@ -2,7 +2,7 @@ const {
   scheduleNewJob,
   saveScheduledJob,
 } = require("../../scheduler.cjs");
-const { v4: uuidv4 } = require("uuid"); // Use UUID for unique IDs
+const { randomUUID } = require("node:crypto");
 const { defaultTimezone } = require("../utils/datetime.cjs");
 
 module.exports = {
@@ -58,7 +58,7 @@ module.exports = {
     }
 
     const newJob = {
-      id: uuidv4(),
+      id: randomUUID(),
       type: "recurring",
       cronString: cronString,
       message: message,
@@ -81,4 +81,3 @@ module.exports = {
     });
   },
 };
-// Note: You need to run `npm install uuid` for this command.

package/src/commands/tts.cjs

@@ -1,36 +1,30 @@
-// Text-to-Speech Command using FREE node-gtts library.
+// Text-to-Speech Command using Google TTS and ffmpeg-static.
 //
-// Audit fix: previously we saved the file as `.mp3` but sent it with
-// `mimetype: "audio/mp4"` and `ptt: true`. Some WhatsApp clients (Telegram-
-// linked viewers, web clients on certain Androids) refuse to play that
-// because the container declared in the mimetype doesn't match the actual
-// MP3 data, hence the "This audio is not available because something is
-// wrong with the audio file" pop-up.
+// Google TTS produces MP3. WhatsApp voice notes are OGG/Opus, so the command:
+//   1. Generates one or more MP3 chunks with @sefinek/google-tts-api.
+//   2. Concatenates the MP3 frames into one temporary file.
+//   3. Invokes the ffmpeg-static binary directly to create OGG/Opus.
 //
-// Proper voice messages on WhatsApp are OGG/Opus. We now:
-//   1. Generate the speech as MP3 via node-gtts (its only supported format).
-//   2. Re-encode it to OGG/Opus with ffmpeg-static.
-//   3. Send with `mimetype: "audio/ogg; codecs=opus"` + `ptt: true`.
-//
-// If ffmpeg isn't available we fall back to sending the raw MP3 with the
-// CORRECT mimetype (`audio/mpeg`) and `ptt: false`, so the user at least
-// gets a playable audio attachment.
+// Calling ffmpeg directly keeps the dependency surface small and avoids the
+// deprecated fluent-ffmpeg wrapper. If ffmpeg is unavailable or transcoding
+// fails, the raw MP3 is still sent as a normal audio attachment.
 
-const gtts = require("node-gtts")("ar");
+const googleTTS = require("@sefinek/google-tts-api");
 const fs = require("fs");
 const fsp = require("fs").promises;
 const path = require("path");
 const os = require("os");
+const { execFile } = require("node:child_process");
+const { promisify } = require("node:util");
 const logger = require("../utils/logger.cjs");
 const { createStatus } = require("../utils/statusMessage.cjs");
-const { sendBotMessage, sendBotError } = require("../utils/sendBotMessage.cjs");
+const { sendBotMessage } = require("../utils/sendBotMessage.cjs");
+
+const execFileAsync = promisify(execFile);
 
-let ffmpeg = null;
 let ffmpegStatic = null;
 try {
-  ffmpeg = require("fluent-ffmpeg");
   ffmpegStatic = require("ffmpeg-static");
-  if (ffmpegStatic) ffmpeg.setFfmpegPath(ffmpegStatic);
 } catch (err) {
   logger.warn(
     { err: err?.message },
@@ -46,26 +40,52 @@ function tmpPath(ext) {
 }
 
 async function synthesizeMp3(text, mp3Path) {
-  return new Promise((resolve, reject) => {
-    gtts.save(mp3Path, text, (err) => (err ? reject(err) : resolve()));
+  const parts = await googleTTS.getAllAudioBase64(text, {
+    lang: "ar",
+    slow: false,
+    timeout: 15_000,
+    splitPunct: "،,.!?؟؛;:\n",
   });
+
+  if (!Array.isArray(parts) || parts.length === 0) {
+    throw new Error("Google TTS returned no audio");
+  }
+
+  const buffers = parts.map((part) => Buffer.from(part.base64, "base64"));
+  await fsp.writeFile(mp3Path, Buffer.concat(buffers));
 }
 
 async function transcodeToOpus(mp3Path) {
-  if (!ffmpeg) return null;
+  if (!ffmpegStatic) return null;
+
   const oggPath = tmpPath("ogg");
-  await new Promise((resolve, reject) => {
-    ffmpeg(mp3Path)
-      .audioCodec("libopus")
-      .audioChannels(1)
-      .audioFrequency(48000)
-      .audioBitrate("48k")
-      .format("ogg")
-      .outputOptions(["-application voip"])
-      .on("error", reject)
-      .on("end", resolve)
-      .save(oggPath);
-  });
+  await execFileAsync(
+    ffmpegStatic,
+    [
+      "-hide_banner",
+      "-loglevel",
+      "error",
+      "-y",
+      "-i",
+      mp3Path,
+      "-vn",
+      "-c:a",
+      "libopus",
+      "-ac",
+      "1",
+      "-ar",
+      "48000",
+      "-b:a",
+      "48k",
+      "-application",
+      "voip",
+      "-f",
+      "ogg",
+      oggPath,
+    ],
+    { windowsHide: true, timeout: 30_000 },
+  );
+
   return oggPath;
 }