levix-bot 2.0.0

package/src/handlers/group.handler.js

@@ -0,0 +1,73 @@
+import { createRequire } from 'module';
+import { delay } from '@whiskeysockets/baileys';
+import { getGroupSettings } from '../utils/storage.esm.js';
+
+const require = createRequire(import.meta.url);
+const logger = require('../utils/logger.cjs');
+
+// Handle group participant updates (join/leave)
+export async function handleGroupParticipantsUpdate(sock, update) {
+  const { id, participants, action } = update;
+  logger.info({ update }, 'Received group participants update');
+
+  if (action !== 'add') {
+    logger.info(`[Group] ${action} action for ${id}`);
+    return;
+  }
+
+  try {
+    const settings = getGroupSettings(id);
+    const welcomeConfig = settings?.welcome_system;
+
+    if (!welcomeConfig || !welcomeConfig.enabled || welcomeConfig.messages.length === 0) {
+      logger.warn(`[Group] Welcome system disabled or no messages for ${id}`);
+      return;
+    }
+
+    // Send welcome message to each new participant
+    for (const participant of participants) {
+      const randomIndex = Math.floor(Math.random() * welcomeConfig.messages.length);
+      const welcomeMessage = welcomeConfig.messages[randomIndex];
+
+      const finalMessage = welcomeMessage.replace(/\${user}/g, `@${participant.split('@')[0]}`);
+
+      await delay(1000);
+      await sock.sendMessage(id, {
+        text: finalMessage,
+        mentions: [participant],
+      });
+    }
+  } catch (error) {
+    logger.error({ err: error, update }, 'Error in group-participants.update event');
+  }
+}
+
+// Handle group join requests
+export async function handleGroupJoinRequests(sock, events) {
+  logger.info({ events }, 'Received group join request update');
+
+  for (const request of events) {
+    if (request.type !== 'request') continue;
+
+    const groupId = request.jid;
+    const participantId = request.from;
+
+    try {
+      const settings = getGroupSettings(groupId);
+
+      if (settings?.join_requests?.auto_approve_enabled) {
+        logger.info(`[Auto-Approve] Approving ${participantId} for group ${groupId}`);
+
+        await sock.groupRequestUpdate(groupId, participantId, 'approve');
+
+        await delay(500);
+        await sock.sendMessage(groupId, {
+          text: `✅ تم قبول طلب انضمام @${participantId.split('@')[0]} تلقائيًا.`,
+          mentions: [participantId],
+        });
+      }
+    } catch (error) {
+      logger.error({ err: error, request }, 'Error in auto-approve event');
+    }
+  }
+}

package/src/handlers/message.handler.js

@@ -0,0 +1,149 @@
+import { createRequire } from "module";
+import { handleCommand } from "./command.handler.js";
+import { handleAntiSpam } from "../middleware/antispam.middleware.js";
+import { checkBlacklist } from "../middleware/blacklist.middleware.js";
+import { trackForwardedMessage } from "../middleware/forward-tracking.middleware.js";
+import { updateUserLastSeen, saveUserMetadata } from "../utils/storage.esm.js";
+import { rememberMessage } from "../utils/recentMessageCache.esm.js";
+import normalizeJid from "../utils/normalizeJid.esm.js";
+
+const require = createRequire(import.meta.url);
+const logger = require("../utils/logger.cjs");
+
+// Envelopes that carry no user-visible content: message revokes and edits
+// (protocolMessage), reactions, poll votes, the undecrypted edit envelope, and
+// the sibling keys WhatsApp ships alongside a real message.
+//
+// These used to be swallowed by the anti-delete handler, which returned early
+// on them. With that handler gone they have to be filtered here instead —
+// otherwise they reach group moderation, where anti-spam counts each one as a
+// message from the sender and deleting a few of your own messages in a row
+// gets you warned or kicked.
+const NON_CONTENT_KEYS = new Set([
+  "protocolMessage",
+  "reactionMessage",
+  "pollUpdateMessage",
+  "secretEncryptedMessage",
+  "senderKeyDistributionMessage",
+  "messageContextInfo",
+]);
+
+// True when the envelope holds something a person actually sent. Note the
+// `.some()`: WhatsApp routinely ships senderKeyDistributionMessage next to a
+// real `conversation`, so we look for any content key rather than testing the
+// first one.
+function hasUserContent(message) {
+  if (!message) return false;
+  return Object.keys(message).some((key) => !NON_CONTENT_KEYS.has(key));
+}
+
+// Handle incoming messages
+export async function handleIncomingMessage(sock, m) {
+  if (m.type !== "notify" || !m.messages[0]) return;
+
+  const msg = m.messages[0];
+
+  // "Message absent from node" is a CIPHERTEXT placeholder: the message node
+  // arrived but its content couldn't be decrypted (Baileys requests a resend).
+  if (msg?.messageStubParameters?.[0] === "Message absent from node") {
+    logger.debug("[Message] Skipping undecryptable/absent message stub");
+    return;
+  }
+
+  // Baileys' getMessage hook needs to hand back messages WE sent when a peer
+  // asks for a retry (see utils/recentMessageCache.esm.js). Only our own
+  // outgoing messages are kept, in memory, and only for that purpose.
+  if (msg.key?.fromMe && msg.key.id && msg.message) {
+    rememberMessage(msg.key.id, msg);
+  }
+
+  if (!hasUserContent(msg.message)) return;
+
+  // Track forwarded messages
+  await trackForwardedMessage(msg);
+
+  // Skip onward processing for status broadcasts and newsletters.
+  if (
+    msg.key.remoteJid === "status@broadcast" ||
+    msg.key.remoteJid?.endsWith("@broadcast") ||
+    msg.key.remoteJid?.endsWith("@newsletter")
+  ) {
+    return;
+  }
+
+  // Parse message context. Crucially we ALSO consider media captions —
+  // otherwise sending an image with caption "!gemini حلل ده" is invisible
+  // to the command handler and the user sees nothing happen.
+  const body =
+    msg.message?.conversation ||
+    msg.message?.extendedTextMessage?.text ||
+    msg.message?.imageMessage?.caption ||
+    msg.message?.videoMessage?.caption ||
+    msg.message?.documentMessage?.caption ||
+    "";
+  const isGroup = msg.key.remoteJid.endsWith("@g.us");
+
+  // Update user metadata (last seen)
+  const senderId = normalizeJid(msg.key.participant || msg.key.remoteJid);
+  if (
+    senderId &&
+    !senderId.includes("@broadcast") &&
+    !senderId.includes("@newsletter")
+  ) {
+    try {
+      saveUserMetadata({
+        jid: senderId,
+        lid: null,
+        phone: senderId.split("@")[0],
+        displayName: msg.pushName || null,
+      });
+      updateUserLastSeen(senderId);
+    } catch (err) {
+      logger.error({ err }, "Failed to update user metadata");
+    }
+  }
+
+  if (isGroup) {
+    const isBlacklisted = await checkBlacklist(sock, msg);
+    if (isBlacklisted) return;
+  }
+
+  // Try to handle as command
+  try {
+    const wasCommand = await handleCommand(sock, msg, body);
+    if (wasCommand) {
+      logger.info(`[Message] Handled as command: "${body}"`);
+      return;
+    }
+  } catch (error) {
+    logger.error({ err: error }, "Error handling command");
+  }
+
+  // Handle regular group messages (moderation)
+  if (isGroup) {
+    await handleGroupModeration(sock, msg);
+  }
+}
+
+// Handle group moderation
+async function handleGroupModeration(sock, msg) {
+  try {
+    const { handleAntiLink } = require("../commands/group/antilink.cjs");
+    const { handleMediaControl } = require("../commands/group/media.cjs");
+
+    const linkActionTaken = await handleAntiLink(sock, msg, {}, normalizeJid);
+    if (linkActionTaken) return;
+
+    const mediaActionTaken = await handleMediaControl(
+      sock,
+      msg,
+      {},
+      normalizeJid
+    );
+    if (mediaActionTaken) return;
+
+    await handleAntiSpam(sock, msg);
+  } catch (error) {
+    logger.error({ err: error }, "Error in group moderation");
+  }
+}

package/src/index.js

@@ -0,0 +1,217 @@
+// Starting Levix.
+//
+// Two shapes, one core:
+//
+//   levix            bootstrapCore() + bootstrapPanel(), then maybe a browser
+//   levix headless   bootstrapCore() only — nothing binds a port
+//
+// The difference is which bootstrap runs, not a flag threaded through the
+// codebase. See src/bootstrap/.
+
+import os from "node:os";
+import { createRequire } from "module";
+import { bootstrapCore } from "./bootstrap/core.js";
+import { flushStore } from "./db/store.esm.js";
+import brand from "./config/brand.esm.js";
+
+const require = createRequire(import.meta.url);
+const logger = require("./utils/logger.cjs");
+const secrets = require("./config/secrets.cjs");
+const settings = require("./config/settings.cjs");
+const { DATA_DIR } = require("./config/paths.cjs");
+const { release: releaseLock } = require("./config/lock.cjs");
+const { close: closeDatabase } = require("./db/db.cjs");
+const { attach } = require("./bootstrap/events.cjs");
+const { openBrowser } = require("./utils/openBrowser.cjs");
+
+const line = (text = "") => console.log(text);
+
+/** `/home/abdo/.levix` reads better as `~/.levix`. */
+function short(path) {
+  const home = os.homedir();
+  return home && path.startsWith(home) ? path.replace(home, "~") : path;
+}
+
+/**
+ * Start Levix.
+ *
+ * @param {object} [options]
+ * @param {boolean} [options.headless] - run the bot with no web panel at all
+ * @param {boolean} [options.open] - open a browser when the environment suits it
+ */
+export async function start({ headless = false, open = true } = {}) {
+  logger.info(`Starting ${brand.name} — ${brand.tagline}`);
+  logger.info(`[Data] ${DATA_DIR}`);
+
+  installShutdownHandlers();
+
+  return headless ? startHeadless() : startWithPanel({ open });
+}
+
+// ---------------------------------------------------------------------------
+// headless
+// ---------------------------------------------------------------------------
+
+async function startHeadless() {
+  line();
+  line(`  ${brand.name} — headless`);
+
+  // Attached before the bot starts, because the QR can arrive during the very
+  // first connection attempt.
+  let announcedPairing = false;
+  attach((event, payload) => {
+    if (event === "qr" && !announcedPairing) {
+      announcedPairing = true;
+      line();
+      line("  No WhatsApp session found.");
+      line();
+      line("  Scan this QR from:");
+      line("  WhatsApp -> Linked devices -> Link a device");
+      line();
+    }
+    if (event === "status_update" && payload?.status === "Connected") {
+      line();
+      line("  ✓ WhatsApp connected");
+    }
+    if (event === "status_update" && payload?.status === "Disconnected") {
+      line("  … WhatsApp disconnected, reconnecting");
+    }
+  });
+
+  const core = await bootstrapCore();
+
+  if (announcedPairing) line("  Waiting for connection...");
+
+  line();
+  line("  ✓ Levix is ready");
+  line();
+  line(`  ${core.commandCount} commands loaded`);
+  line(`  Data: ${short(DATA_DIR)}`);
+  line();
+  line("  No web panel in this mode. Press Ctrl+C to stop.");
+  line();
+
+  return core;
+}
+
+// ---------------------------------------------------------------------------
+// with the panel
+// ---------------------------------------------------------------------------
+
+async function startWithPanel({ open }) {
+  const { bootstrapPanel, panelUrl } = await import("./bootstrap/panel.js");
+
+  let setBotInstance = null;
+  let setBotControls = null;
+
+  // The panel needs the live socket, and a reconnect replaces it. Passing the
+  // callback into the core keeps that true without the core knowing what a
+  // panel is.
+  const core = await bootstrapCore({
+    onSocket(sock, controls) {
+      if (setBotInstance) setBotInstance(sock);
+      if (setBotControls) setBotControls({ clearAll: controls.clearAll });
+    },
+  });
+
+  let panel;
+  try {
+    panel = await bootstrapPanel({ core });
+  } catch (error) {
+    if (error.code === "EADDRINUSE") {
+      console.error(`\n  ${error.message}\n`);
+      logger.error(error.message);
+      process.exit(1);
+    }
+    throw error;
+  }
+
+  ({ setBotInstance, setBotControls } = panel);
+  setBotInstance(core.sock);
+
+  const firstRun = !secrets.hasDashboardPassword();
+  const url = panelUrl({ port: panel.port, firstRun });
+
+  logger.info(`✅ Control panel: ${url}`);
+
+  line();
+  line(`  ${brand.name} is running`);
+  line();
+  line(`  Panel: ${url}`);
+  line(`  Data:  ${short(DATA_DIR)}`);
+
+  if (firstRun && !settings.get("public_domain")) {
+    line();
+    line("  First run — that link asks you to pick a password.");
+    line(`  Opening it from another machine also needs this code: ${secrets.getSetupCode()}`);
+  }
+
+  if (open) {
+    const { opened, reason } = openBrowser(url);
+    line();
+    line(
+      opened
+        ? `  Opening ${brand.name} in your browser...`
+        : `  Open that link yourself (${reason}).`
+    );
+  }
+
+  line();
+  line("  Press Ctrl+C to stop.");
+  line();
+
+  return { ...core, panel, url };
+}
+
+// ---------------------------------------------------------------------------
+// living and dying
+// ---------------------------------------------------------------------------
+
+function installShutdownHandlers() {
+  // After an uncaughtException the process state is unknown (a half-held lock,
+  // a half-written auth row). Log and exit rather than keep working on top of
+  // it. Run the bot under a supervisor (systemd / pm2 / docker restart) so it
+  // comes back on its own — without one, this exit means the bot is down.
+  const fatal = (error, label) => {
+    logger.error(error, `${label} exiting — restart is up to the supervisor`);
+    console.error(label, error);
+    // Half a second so pino can drain its worker before we die.
+    setTimeout(() => process.exit(1), 500).unref();
+  };
+
+  process.on("uncaughtException", (error) => fatal(error, "Uncaught Exception:"));
+  process.on("unhandledRejection", (error) => fatal(error, "Unhandled Rejection:"));
+
+  let shuttingDown = false;
+  const shutdown = async (signal) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    logger.info(`[shutdown] ${signal} received, closing down...`);
+
+    const finish = async () => {
+      await Promise.allSettled([flushStore()]);
+      closeDatabase();
+      releaseLock();
+      process.exit(0);
+    };
+
+    // The panel may not exist at all (headless), and if it does it may not be
+    // listening yet. Reaching into the module cache rather than requiring it
+    // keeps this from constructing an Express app during shutdown.
+    let server = null;
+    try {
+      const cached = require.cache[require.resolve("../app.cjs")];
+      server = cached?.exports?.server ?? null;
+    } catch {}
+
+    if (server?.listening) server.close(finish);
+    else await finish();
+
+    // Don't wait forever on a request that refuses to end.
+    setTimeout(() => process.exit(1), 10_000).unref();
+  };
+
+  ["SIGTERM", "SIGINT"].forEach((signal) => process.on(signal, () => shutdown(signal)));
+}
+
+export default start;

package/src/middleware/antispam.middleware.js

@@ -0,0 +1,68 @@
+import { createRequire } from 'module';
+import { getGroupSettings } from '../utils/storage.esm.js';
+import normalizeJid from '../utils/normalizeJid.esm.js';
+import {
+  isOwnerJid,
+  isAdminInGroup,
+} from '../utils/permissions.esm.js';
+
+const require = createRequire(import.meta.url);
+const logger = require('../utils/logger.cjs');
+
+const userMessageTimestamps = new Map();
+
+// Handle anti-spam detection and action
+export async function handleAntiSpam(sock, msg) {
+  const groupId = msg.key.remoteJid;
+  if (!groupId.endsWith('@g.us')) return;
+
+  const senderId = normalizeJid(msg.key.participant);
+  const settings = getGroupSettings(groupId);
+  const spamConfig = settings?.antispam;
+
+  if (!spamConfig || !spamConfig.enabled) return;
+
+  // Owners and admins are immune. The legacy owner mirror it used to import was
+  // only ever populated with the bot's own JID, so real operators were
+  // counted as spammers — the centralized check fixes that.
+  const isOwner = isOwnerJid(senderId);
+  const groupMetadata = await sock.groupMetadata(groupId);
+  const isSenderAdmin = isAdminInGroup(groupMetadata, senderId);
+
+  if (isOwner || isSenderAdmin) return;
+
+  // Track message timestamps
+  const now = Date.now();
+  if (!userMessageTimestamps.has(senderId)) {
+    userMessageTimestamps.set(senderId, []);
+  }
+
+  const userTimestamps = userMessageTimestamps.get(senderId);
+  userTimestamps.push(now);
+
+  // Filter timestamps within time window
+  const timeWindow = (spamConfig.time_window || 10) * 1000;
+  const recentTimestamps = userTimestamps.filter((ts) => now - ts < timeWindow);
+  userMessageTimestamps.set(senderId, recentTimestamps);
+
+  // Check if user exceeded message count
+  if (recentTimestamps.length > (spamConfig.message_count || 5)) {
+    logger.warn({ user: senderId, group: groupId }, 'Spam detected, taking action.');
+
+    // Take action based on config
+    if (spamConfig.action === 'KICK') {
+      await sock.sendMessage(groupId, {
+        text: `🚫 تم حذف @${senderId.split('@')[0]} بسبب الإزعاج (Spam).`,
+        mentions: [senderId],
+      });
+      await sock.groupParticipantsUpdate(groupId, [senderId], 'remove');
+    } else {
+      await sock.sendMessage(groupId, {
+        text: `⚠️ تحذير لـ @${senderId.split('@')[0]}! الرجاء عدم إرسال رسائل مزعجة.`,
+        mentions: [senderId],
+      });
+    }
+
+    userMessageTimestamps.delete(senderId);
+  }
+}

package/src/middleware/blacklist.middleware.js

@@ -0,0 +1,29 @@
+import { createRequire } from 'module';
+import { getGroupSettings } from '../utils/storage.esm.js';
+import normalizeJid from '../utils/normalizeJid.esm.js';
+
+const require = createRequire(import.meta.url);
+const logger = require('../utils/logger.cjs');
+
+// Check if user is blacklisted in the group
+export async function checkBlacklist(sock, msg) {
+  const groupId = msg.key.remoteJid;
+  if (!groupId.endsWith('@g.us')) return false;
+
+  const senderId = normalizeJid(msg.key.participant || msg.key.remoteJid);
+  const settings = getGroupSettings(groupId);
+
+  if (settings?.blacklist?.includes(senderId)) {
+    const groupMetadata = await sock.groupMetadata(groupId);
+    const isSenderAdmin = groupMetadata.participants.some(
+      (p) => p.admin && p.id === senderId
+    );
+
+    if (!isSenderAdmin) {
+      logger.info(`Ignoring message from blacklisted user ${senderId}`);
+      return true;
+    }
+  }
+
+  return false;
+}

package/src/middleware/forward-tracking.middleware.js

@@ -0,0 +1,49 @@
+// file: /middleware/forward-tracking.middleware.js
+import { createRequire } from "module";
+import { incrementForwardScore } from "../utils/storage.esm.js";
+import normalizeJid from "../utils/normalizeJid.esm.js";
+
+const require = createRequire(import.meta.url);
+const logger = require("../utils/logger.cjs");
+
+/**
+ * Track forwarded messages and increment their score
+ * @param {object} msg - WhatsApp message object
+ */
+export async function trackForwardedMessage(msg) {
+  try {
+    // Check if this is a forwarded message
+    const contextInfo =
+      msg.message?.extendedTextMessage?.contextInfo ||
+      msg.message?.imageMessage?.contextInfo ||
+      msg.message?.videoMessage?.contextInfo ||
+      msg.message?.documentMessage?.contextInfo ||
+      msg.message?.audioMessage?.contextInfo;
+
+    // A message is considered forwarded if it has isForwarded flag or forwardingScore > 0
+    const isForwarded = contextInfo?.isForwarded || (contextInfo?.forwardingScore && contextInfo.forwardingScore > 0);
+
+    if (!isForwarded) {
+      return false;
+    }
+
+    const messageId = msg.key.id;
+    const groupId = msg.key.remoteJid;
+    const senderId = normalizeJid(msg.key.participant || msg.key.remoteJid);
+
+    // Only track forwarded messages in groups
+    if (!groupId.endsWith("@g.us")) {
+      return false;
+    }
+
+    // Increment the forward score
+    const newScore = incrementForwardScore(messageId, groupId, senderId);
+
+    logger.info(`[Forward Tracking] Message ${messageId} forwarded. New score: ${newScore}`);
+
+    return true;
+  } catch (error) {
+    logger.error({ err: error }, "Error tracking forwarded message");
+    return false;
+  }
+}