levix-bot 2.0.0

package/bin/levix.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// The `levix` command. Everything it does lives in src/cli.js, so the packaged
+// executable and this wrapper share one implementation.
+
+import { run } from "../src/cli.js";
+
+await run(process.argv);

package/deploy/install.sh

@@ -0,0 +1,182 @@
+#!/usr/bin/env bash
+# Install Levix on a Linux server and run it as a service.
+#
+#   curl -fsSL https://levix.leviro.net/install.sh | bash
+#
+# This file is the source of every public installer. The copy served from
+# levix.leviro.net/install/vX.Y.Z.sh is this same script with VERSION rewritten
+# to that release, which is why a pinned URL keeps installing that version
+# forever. The copy in git leaves VERSION as "latest".
+#
+# What it does, in order — read it before you pipe it into a shell, as you
+# should with any script that asks for sudo:
+#
+#   1. checks for Node 24+ and stops with instructions if it isn't there
+#   2. installs the `levix` command globally from the `levix-bot` npm package
+#   3. creates a `levix` system user and /var/lib/levix for its data
+#   4. installs the systemd unit, pointed at the levix it just installed
+#   5. enables it, starts it, and prints where to go next
+#   6. offers — but never assumes — to connect a domain
+#
+# It writes exactly three things outside npm's own prefix: the system user,
+# /var/lib/levix, and /etc/systemd/system/levix.service. It never touches an
+# existing installation's data, and it can be re-run to upgrade.
+
+set -euo pipefail
+
+PACKAGE="levix-bot"
+# Rewritten by scripts/build-release-installer.mjs when a release is published.
+# Keep this line exactly as it is: one assignment, one double-quoted value.
+VERSION="latest"
+SERVICE="levix"
+DATA_DIR="/var/lib/levix"
+UNIT="/etc/systemd/system/${SERVICE}.service"
+MIN_NODE_MAJOR=24
+PORT=3001
+
+say() { printf '\n  %s\n' "$*"; }
+die() { printf '\n  error: %s\n\n' "$*" >&2; exit 1; }
+
+sudo_if_needed() {
+  if [ "$(id -u)" -eq 0 ]; then
+    "$@"
+  else
+    command -v sudo >/dev/null 2>&1 || die "This needs root, and sudo is not installed."
+    sudo "$@"
+  fi
+}
+
+# --- 1. Node ---------------------------------------------------------------
+
+command -v node >/dev/null 2>&1 ||
+  die "Node is not installed. Get Node ${MIN_NODE_MAJOR} LTS from https://nodejs.org"
+
+NODE_MAJOR="$(node -p 'process.versions.node.split(".")[0]')"
+if [ "$NODE_MAJOR" -lt "$MIN_NODE_MAJOR" ]; then
+  die "Node ${MIN_NODE_MAJOR}+ is required (found $(node -v)). Levix stores everything in SQLite, which Node only ships with itself from ${MIN_NODE_MAJOR} on."
+fi
+
+command -v npm >/dev/null 2>&1 || die "npm is not installed."
+command -v systemctl >/dev/null 2>&1 ||
+  die "This script installs a systemd service, and systemd isn't here. Run 'npm i -g ${PACKAGE}' and start 'levix' yourself."
+
+say "Node $(node -v) — good."
+
+# --- 2. The package --------------------------------------------------------
+
+if [ "$VERSION" = "latest" ]; then
+  say "Installing ${PACKAGE}…"
+else
+  say "Installing ${PACKAGE} ${VERSION}…"
+fi
+sudo_if_needed npm install -g "${PACKAGE}@${VERSION}"
+
+# Where did it land? `/usr/bin/env levix` in the unit would depend on systemd's
+# PATH, which does not include nvm's prefix and is not guaranteed to include
+# npm's. Resolve it now and write the real path into the unit.
+LEVIX_BIN="$(command -v levix || true)"
+if [ -z "$LEVIX_BIN" ]; then
+  NPM_BIN="$(npm bin -g 2>/dev/null || npm prefix -g 2>/dev/null)/bin"
+  [ -x "${NPM_BIN}/levix" ] && LEVIX_BIN="${NPM_BIN}/levix"
+fi
+[ -n "$LEVIX_BIN" ] || die "levix installed but could not be found on PATH."
+say "Installed at ${LEVIX_BIN}"
+
+# --- 3. User and data directory -------------------------------------------
+
+if ! id -u levix >/dev/null 2>&1; then
+  say "Creating the levix system user…"
+  sudo_if_needed useradd --system --home-dir "$DATA_DIR" --shell /usr/sbin/nologin levix
+fi
+
+sudo_if_needed mkdir -p "$DATA_DIR"
+sudo_if_needed chown -R levix:levix "$DATA_DIR"
+# The database holds the WhatsApp session and the panel password hash. Nobody
+# else on the machine has any business reading it.
+sudo_if_needed chmod 750 "$DATA_DIR"
+
+# --- 4. The service --------------------------------------------------------
+
+say "Installing the systemd service…"
+
+UNIT_SOURCE=""
+for candidate in \
+  "$(npm root -g 2>/dev/null)/${PACKAGE}/deploy/levix.service" \
+  "$(dirname "$0")/levix.service"; do
+  if [ -f "$candidate" ]; then UNIT_SOURCE="$candidate"; break; fi
+done
+[ -n "$UNIT_SOURCE" ] || die "Couldn't find the unit file to install."
+
+# Written through a temp file in the same directory, then moved into place, so
+# an interrupted run never leaves systemd a half-written unit. mktemp, not a
+# predictable name in /tmp.
+TMP_UNIT="$(mktemp)"
+trap 'rm -f "$TMP_UNIT"' EXIT
+
+sed "s|^ExecStart=.*|ExecStart=${LEVIX_BIN} --data ${DATA_DIR}|" "$UNIT_SOURCE" > "$TMP_UNIT"
+grep -q "^ExecStart=${LEVIX_BIN}" "$TMP_UNIT" || die "Failed to set ExecStart in the unit file."
+
+sudo_if_needed install -m 0644 -o root -g root "$TMP_UNIT" "$UNIT"
+
+sudo_if_needed systemctl daemon-reload
+sudo_if_needed systemctl enable "$SERVICE"
+sudo_if_needed systemctl restart "$SERVICE"
+
+# --- 5. Did it actually start? --------------------------------------------
+
+started=0
+for _ in $(seq 1 30); do
+  if systemctl is-active --quiet "$SERVICE"; then started=1; break; fi
+  sleep 1
+done
+
+if [ "$started" -ne 1 ]; then
+  printf '\n  Levix was installed but the service did not start.\n\n'
+  printf '  What systemd says:\n\n'
+  sudo_if_needed systemctl status "$SERVICE" --no-pager --lines 20 || true
+  printf '\n  Full log: journalctl -u %s -n 50\n\n' "$SERVICE"
+  exit 1
+fi
+
+IP="$(hostname -I 2>/dev/null | awk '{print $1}')"
+
+cat <<EOF
+
+  Levix is running.
+
+    Control panel   http://${IP:-<this server>}:${PORT}/
+    Data            ${DATA_DIR}
+    Logs            journalctl -u ${SERVICE} -f
+
+  Open the panel and pick a password. Opening it from another machine also
+  asks for a setup code — this prints it:
+
+    journalctl -u ${SERVICE} -n 40 | grep -A3 'Setup code'
+
+  Then scan the QR from the Connection screen with WhatsApp.
+
+EOF
+
+# --- 6. A domain, if they want one now ------------------------------------
+
+# Optional, and entirely skippable: an IP is a perfectly good way to run this,
+# and `levix domain` works just as well next week. Only ask when there is
+# somebody at the keyboard — piping this script into bash gives us no stdin.
+if [ -t 0 ]; then
+  printf '  The panel has no HTTPS of its own. Connect a domain now? [y/N] '
+  read -r answer </dev/tty || answer=""
+  case "$answer" in
+    [yY]*)
+      # One implementation, in the CLI. This script does not have its own.
+      sudo_if_needed "$LEVIX_BIN" --data "$DATA_DIR" domain
+      ;;
+    *)
+      printf '\n  Fine — run this whenever you are ready:\n\n    sudo levix --data %s domain bot.example.com\n\n' "$DATA_DIR"
+      ;;
+  esac
+else
+  printf '  To put it behind a domain with HTTPS:\n\n    sudo levix --data %s domain bot.example.com\n\n' "$DATA_DIR"
+fi
+
+printf '  If this server is on the public internet, do that (or put it behind\n'
+printf '  your own reverse proxy) before sharing the panel address.\n\n'

package/deploy/levix.service

@@ -0,0 +1,56 @@
+# systemd unit for Levix.
+#
+#   sudo cp deploy/levix.service /etc/systemd/system/
+#   sudo systemctl enable --now levix
+#   journalctl -u levix -f          # the setup code is printed here on first run
+#
+# deploy/install.sh installs this and rewrites ExecStart with the real path of
+# the `levix` command it just installed — `/usr/bin/env levix` only works when
+# npm's global bin is on systemd's own PATH, which it is not under nvm and not
+# on every distro. If you are installing this by hand, check that line.
+
+[Unit]
+Description=Levix WhatsApp bot
+Documentation=https://github.com/Abdodiab2005/levix
+After=network-online.target
+Wants=network-online.target
+
+# A misconfiguration — a port permanently taken, a corrupt install — must not
+# turn into a restart loop that spins the CPU and fills the journal forever.
+# Five failures in a minute and systemd stops trying, leaving the unit failed
+# where `systemctl status` will show it.
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=simple
+User=levix
+Group=levix
+ExecStart=/usr/bin/env levix --data /var/lib/levix
+Restart=always
+# Long enough not to hammer, short enough to recover from a blip unattended.
+RestartSec=5
+KillSignal=SIGTERM
+# Long enough for the database to checkpoint and the socket to close cleanly.
+TimeoutStopSec=30
+
+# Everything it writes is under one directory, which makes the rest of this
+# easy. StateDirectory creates it and fixes its ownership on every start.
+StateDirectory=levix
+WorkingDirectory=/var/lib/levix
+
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/levix
+ProtectKernelTunables=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+# The bot needs outbound network and nothing else; it binds an ordinary port,
+# so it never needs a capability.
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+CapabilityBoundingSet=
+
+[Install]
+WantedBy=multi-user.target

package/deploy/nginx/levix.leviro.net.conf

@@ -0,0 +1,79 @@
+# Reference Nginx configuration for the Levix download host.
+#
+# This file is documentation, not something Levix installs. Copy the parts you
+# need into the server block that already serves levix.leviro.net.
+#
+# Two things live on that hostname:
+#
+#   /install.sh, /install, /install/*   static files, published by a release
+#   everything else                      the Next.js site, on 127.0.0.1:3000
+#
+# The installers are plain files on disk. Publishing a release replaces one of
+# them with a rename; nothing here needs a reload, a restart, or an Nginx that
+# knows anything about releases.
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name levix.leviro.net;
+
+    # ssl_certificate / ssl_certificate_key — whatever certbot or your existing
+    # setup already wrote for this host.
+
+    charset utf-8;
+
+    # `location =` is an exact match and Nginx settles it before it looks at
+    # anything else, so this can never fall through to the proxy below.
+    location = /install.sh {
+        alias /var/www/levix-downloads/install.sh;
+
+        # Readable in a browser. Anyone about to pipe this into a shell should
+        # be able to click the URL and read it first — that is the whole point
+        # of publishing the source rather than a binary.
+        default_type text/plain;
+        add_header Content-Disposition "inline" always;
+
+        # A moving alias. Serving yesterday's stable installer from a cache
+        # after a release is the one failure this endpoint must not have.
+        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+    }
+
+    # Convenience only. The command in the documentation stays /install.sh.
+    location = /install {
+        return 302 /install.sh;
+    }
+
+    # `^~` stops Nginx from considering any regex location for these, so a
+    # future regex rule for the site cannot start swallowing installer URLs.
+    location ^~ /install/ {
+        alias /var/www/levix-downloads/install/;
+
+        default_type text/plain;
+        add_header Content-Disposition "inline" always;
+
+        # These files are immutable: v2.0.1.sh is written once and never
+        # rewritten, so it can be cached for as long as anyone likes.
+        add_header Cache-Control "public, max-age=31536000, immutable" always;
+
+        autoindex off;
+    }
+
+    # Everything else is the website, which knows nothing about any of this.
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# For the Upgrade header above, if the site does not already define it:
+#
+#   map $http_upgrade $connection_upgrade {
+#       default upgrade;
+#       ''      close;
+#   }

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "levix-bot",
+  "version": "2.0.0",
+  "description": "A self-hosted personal WhatsApp bot with an AI agent, group moderation and a web control panel.",
+  "main": "src/index.js",
+  "scripts": {
+    "start": "node bin/levix.js",
+    "dev": "nodemon bin/levix.js",
+    "test": "node tests/run.mjs",
+    "brand:assets": "node scripts/build-brand-assets.mjs",
+    "build:sea": "node scripts/build-sea.mjs",
+    "validate:tarball": "node scripts/validate-tarball.mjs",
+    "validate:sea": "node scripts/validate-sea.mjs",
+    "validate:docker": "bash scripts/validate-docker.sh"
+  },
+  "keywords": [
+    "whatsapp",
+    "bot",
+    "baileys",
+    "gemini",
+    "ai-agent",
+    "sqlite",
+    "self-hosted"
+  ],
+  "author": "Abdelrhman Diab (Leviro)",
+  "license": "MIT",
+  "type": "module",
+  "dependencies": {
+    "@google/generative-ai": "^0.24.1",
+    "@whiskeysockets/baileys": "7.0.0-rc13",
+    "axios": "^1.9.0",
+    "ejs": "^3.1.10",
+    "express": "^5.1.0",
+    "express-session": "^1.18.1",
+    "ffmpeg-static": "^5.2.0",
+    "fluent-ffmpeg": "^2.1.3",
+    "node-cache": "^5.1.2",
+    "node-cron": "^4.1.0",
+    "node-gtts": "^2.0.2",
+    "pino": "^9.7.0",
+    "pino-pretty": "^13.0.0",
+    "qrcode": "^1.5.4",
+    "qrcode-terminal": "^0.12.0",
+    "socket.io": "^4.8.1",
+    "uuid": "^11.1.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Abdodiab2005/levix.git"
+  },
+  "homepage": "https://github.com/Abdodiab2005/levix",
+  "bugs": {
+    "url": "https://github.com/Abdodiab2005/levix/issues"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "devDependencies": {
+    "esbuild": "^0.28.2",
+    "postject": "^1.0.0-alpha.6",
+    "sharp": "^0.35.3"
+  },
+  "bin": {
+    "levix": "bin/levix.js"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "views/",
+    "public/",
+    "deploy/",
+    "app.cjs",
+    "scheduler.cjs",
+    "README.md",
+    "SETUP.md",
+    "LICENSE"
+  ]
+}

package/public/brand/mark.svg

@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" fill="none">
+  <defs>
+    <linearGradient id="levix-gradient" x1="15" y1="86" x2="87" y2="14" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#0045FF"/>
+      <stop offset=".55" stop-color="#0066F5"/>
+      <stop offset="1" stop-color="#00D4FF"/>
+    </linearGradient>
+  </defs>
+  <path d="M75.5 55.2C77.8 50.9 79 46 79 41C79 22 63.5 7.5 44 7.5C24.2 7.5 8.5 22.1 8.5 41C8.5 53.5 15.8 64.6 27.2 70.4L23.3 84.5L39.6 76.7C44.3 78.1 49.2 78.4 54.4 76.8" stroke="url(#levix-gradient)" stroke-width="8.5" stroke-linecap="round" stroke-linejoin="round"/>
+  <circle cx="34.8" cy="42.7" r="4.1" fill="url(#levix-gradient)"/>
+  <circle cx="55.4" cy="42.7" r="4.1" fill="url(#levix-gradient)"/>
+  <path d="M39.5 51.8C42.7 55.8 47.7 55.8 50.9 51.8" stroke="url(#levix-gradient)" stroke-width="3.8" stroke-linecap="round"/>
+  <path d="M59.2 59.2L83.2 83.2M84.2 57.8L58.4 83.2" stroke="url(#levix-gradient)" stroke-width="8.2" stroke-linecap="round"/>
+  <path d="M83.2 16.5C84.3 20.7 86.3 22.8 90.5 23.9C86.3 25 84.3 27.1 83.2 31.3C82.1 27.1 80.1 25 75.9 23.9C80.1 22.8 82.1 20.7 83.2 16.5Z" fill="url(#levix-gradient)"/>
+</svg>
+